The article assumes that engineers have the technical wherewithal to know when they should manually upgrade their dependencies! Clearly I should have mentioned

The article assumes that engineers have the technical wherewithal to know when they should manually upgrade their dependencies! Clearly I should have mentioned that Dependabot (and probably others) don't consider cooldown when suggesting security upgrades. That's documented here[1]. [1]: https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference#cooldown- https://docs.github.com/en/code-security/dependabot/working-...