xavierk
73d33a7228
Semgrep's missing-cooldown rules flag Dependabot and uv configs that apply newly published releases immediately. Dependabot waits seven days before proposing updates, and [tool.uv] sets exclude-newer to seven days. uv.lock was regenerated with uv 0.13.3 (the pinned version). The only change is the [options] block that records the cutoff: the same 165 packages resolve, and all eight requirements/*.txt exports are byte-identical to the committed files.
17 lines
528 B
YAML
17 lines
528 B
YAML
version: 2
|
|
updates:
|
|
# Actions are pinned by commit SHA (tests/test_workflow_action_pins.py), which
|
|
# is only safe if something moves the pins: an action nobody bumps stops
|
|
# receiving its own security fixes, and the pin hides that it has gone stale.
|
|
# Grouped so this arrives as one pull request a week rather than fifteen.
|
|
- package-ecosystem: github-actions
|
|
directory: /
|
|
schedule:
|
|
interval: weekly
|
|
cooldown:
|
|
default-days: 7
|
|
groups:
|
|
github-actions:
|
|
patterns:
|
|
- '*'
|