chore(ci): add dependency cooldowns to dependabot and uv

Semgrep's missing-cooldown rules flag Dependabot and uv configs that apply newly published releases immediately. Dependabot waits seven days before proposing updates, and [tool.uv] sets exclude-newer to seven days. uv.lock was regenerated with uv 0.13.3 (the pinned version). The only change is the [options] block that records the cutoff: the same 165 packages resolve, and all eight requirements/*.txt exports are byte-identical to the committed files.
2026-11-06 19:29:21 +05:30
parent 09690e5c77
commit 73d33a7228
3 changed files with 8 additions and 0 deletions
@@ -8,6 +8,8 @@ updates:
    directory: /
    schedule:
      interval: weekly
+    cooldown:
+      default-days: 7
    groups:
      github-actions:
        patterns: