From eb7c0085a523e08e17a88879bf70ccbc50876b3c Mon Sep 17 00:00:00 2001
From: Chris Sinjakli <sinjo@planetscale.com>
Date: Thu, 9 Apr 2026 11:28:10 +0100
Subject: [PATCH] Add a 14 day dependency cooldown to the Dependabot config

As a mitigation against supply-chain attacks, we're adopting a 14 day
cooldown on dependency updates. This covers a lot of the supply chain
attacks via compromised dependencies that have been seen in the wild so
far, where the compromised version is only available for less than a
day.

This isn't perfect, or the whole story, but it's a good next step for us
to take.
---
 .github/dependabot.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index eb4bfe6e..bad338b1 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -9,3 +9,5 @@ updates:
     directory: "/" # Location of package manifests
     schedule:
       interval: "daily"
+    cooldown:
+      default-days: 14