Skip to content

Commit 269f140

Browse files
committed
tools: exclude @node-core/doc-kit from dependabot cooldown
`@node-core/doc-kit` is an internal package maintained within the nodejs organization, which is unlikely to be a direct source of supply-chain attack. The cooldown only slow down the propagation of new improvements from doc-kit to Node.js repo and causes surprises. The cooldown should be configured in the `doc-kit` repository instead. Currently there is a 3-day cooldown. Maybe we need to increase that to match the 5-day cooldown used in this repository. This patch excludes `@node-core/doc-kit` from the cooldown. Note that `@node-core/doc-kit` is the only dependency in `tools/doc`. But to be future proof, I did't remove the cooldown directly.
1 parent db9da5d commit 269f140

File tree

1 file changed

+2
-0
lines changed

1 file changed

+2
-0
lines changed

.github/dependabot.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,8 @@ updates:
1818
semver-major-days: 5
1919
semver-minor-days: 5
2020
semver-patch-days: 5
21+
exclude:
22+
- "@node-core/doc-kit"
2123
commit-message:
2224
prefix: tools
2325
open-pull-requests-limit: 10

0 commit comments

Comments
 (0)