4 ms·
Too bad dependabot cooldowns are brain-dead. If you set a cooldown for one week, and your dependency can't get their act together and makes a release daily, it'
by mook 7mo ago
Too bad dependabot cooldowns are brain-dead. If you set a cooldown for one week, and your dependency can't get their act together and makes a release daily, it'll start making PRs for the first (oldest) release in the series after a week even though there's nothing cool about the release cadence.
- kleyd 7mo agoThe cooldown is to allow vulnerabilities to be discovered. So auto update on passing tests, which should include an npm audit check.