From 73d33a72284e228a7dfaa3d346555bc89a7c7e3d Mon Sep 17 00:00:00 2001 From: Xavier Karma Date: Fri, 6 Nov 2026 19:29:21 +0530 Subject: [PATCH] chore(ci): add dependency cooldowns to dependabot and uv Semgrep's missing-cooldown rules flag Dependabot and uv configs that apply newly published releases immediately. Dependabot waits seven days before proposing updates, and [tool.uv] sets exclude-newer to seven days. uv.lock was regenerated with uv 0.13.3 (the pinned version). The only change is the [options] block that records the cutoff: the same 165 packages resolve, and all eight requirements/*.txt exports are byte-identical to the committed files. --- .github/dependabot.yml | 2 ++ pyproject.toml | 2 ++ uv.lock | 4 ++++ 3 files changed, 8 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index e684638..9b92698 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -8,6 +8,8 @@ updates: directory: / schedule: interval: weekly + cooldown: + default-days: 7 groups: github-actions: patterns: diff --git a/pyproject.toml b/pyproject.toml index 0b46612..1866cdc 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -133,6 +133,8 @@ Changelog = "https://github.com/VocaHQ/vocalinux/releases" # Contributors may use uv 0.12 or 0.13. CI and lock/export generation use # uv 0.13.3 for reproducible export formatting (see `just lock`). required-version = ">=0.12,<0.14" +# Supply-chain cooldown: wait a week before resolving newly published releases. +exclude-newer = "7 days" [tool.setuptools] # Resource dirs carry no .py files, but setuptools still treats them as packages. diff --git a/uv.lock b/uv.lock index 199f238..b497bb4 100644 --- a/uv.lock +++ b/uv.lock @@ -10,6 +10,10 @@ resolution-markers = [ "python_full_version < '3.12' and sys_platform == 'ios'", ] +[options] +exclude-newer = "0001-01-01T00:00:00Z" # This has no effect and is included for backwards compatibility when using relative exclude-newer values. +exclude-newer-span = "P7D" + [[package]] name = "alabaster" version = "1.0.0"