Skip to content

Commit e4b7451

Browse files
committed
tools: exclude @node-core/doc-kit from dependabot cooldown
`@node-core/doc-kit` is an internal package maintained within the nodejs organization, which is unlikely to be a direct source of supply-chain attack. The cooldown only slow down the propagation of new improvements from doc-kit to Node.js repo and causes surprises. The cooldown should be configured in the `doc-kit` repository instead. Currently there is a 3-day cooldown. Maybe we need to increase that to match the 5-day cooldown used in this repository. This patch excludes `@node-core/doc-kit` from the cooldown. Note that `@node-core/doc-kit` is the only dependency in `tools/doc`. But to be future proof, I did't remove the cooldown directly.
1 parent db9da5d commit e4b7451

File tree

1 file changed

+2
-0
lines changed

1 file changed

+2
-0
lines changed

.github/dependabot.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,8 @@ updates:
5252
semver-major-days: 5
5353
semver-minor-days: 5
5454
semver-patch-days: 5
55+
exclude:
56+
- '@node-core/doc-kit'
5557
commit-message:
5658
prefix: tools
5759
open-pull-requests-limit: 10

0 commit comments

Comments
 (0)