feat(deps): add 7-day dependency cooldown for supply chain safety#122
feat(deps): add 7-day dependency cooldown for supply chain safety#122rlorenzo wants to merge 1 commit intoupgrade/lts-dotnet10-node24from
Conversation
rlorenzo
commented
Mar 26, 2026
rlorenzo
commented
- Dependabot: weekly Monday checks with 7d cooldown (14d for majors) across nuget, npm, and github-actions ecosystems
- npm: pin 11.12.0 via Volta and set min-release-age=604800 in .npmrc
- Dependabot: weekly Monday checks with 7d cooldown (14d for majors) across nuget, npm, and github-actions ecosystems - npm: pin 11.12.0 via Volta and set min-release-age=604800 in .npmrc
There was a problem hiding this comment.
Pull request overview
Adds dependency “cooldown”/minimum-age controls to reduce exposure to newly-published supply-chain compromises, and pins npm via Volta for more reproducible tooling.
Changes:
- Add Dependabot configuration for NuGet, npm (root +
VueApp), and GitHub Actions with weekly scheduling and cooldown windows. - Pin
npm@11.12.0via Volta in the rootpackage.json. - Add
.npmrcwithmin-release-age=604800(7 days).
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
package.json |
Pins npm via Volta at the repo root to standardize tooling. |
.npmrc |
Introduces a minimum release age setting intended to delay adoption of fresh releases. |
.github/dependabot.yml |
Configures Dependabot updates across ecosystems with grouping and cooldown periods. |
| "node": "24.14.0", | ||
| "npm": "11.12.0" |
There was a problem hiding this comment.
The repo has a separate VueApp/package.json with its own volta section (pins Node only). Volta resolves tool versions from the nearest package.json, so running commands from VueApp/ may use an unpinned npm version even though the root pins npm here. Consider also pinning npm in VueApp/package.json (or removing the nested Volta config so it inherits from the root) to keep npm consistent across the repo and avoid lockfile-version churn.
| "node": "24.14.0", | |
| "npm": "11.12.0" | |
| "node": "24.14.0" |
