Commit bdee0a8
tools: exclude @node-core/doc-kit from dependabot cooldown
`@node-core/doc-kit` is an internal package maintained within the nodejs
organization, which is unlikely to be a direct source of supply-chain
attack. The cooldown only slow down the propagation of new improvements
from doc-kit to Node.js repo and causes surprises.
The cooldown should be configured in the `doc-kit` repository instead.
Currently there is a 3-day cooldown. Maybe we need to increase that to
match the 5-day cooldown used in this repository.
This patch excludes `@node-core/doc-kit` from the cooldown.
Note that `@node-core/doc-kit` is the only dependency in `tools/doc`.
But to be future proof, I did't remove the cooldown directly.
PR-URL: #62775
Reviewed-By: Claudio Wunder <cwunder@gnome.org>
Reviewed-By: Xuguang Mei <meixuguang@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>1 parent c27f3cf commit bdee0a8
1 file changed
Lines changed: 2 additions & 0 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -52,6 +52,8 @@ updates: | |||
| 52 | 52 | semver-major-days: 5 | |
| 53 | 53 | semver-minor-days: 5 | |
| 54 | 54 | semver-patch-days: 5 | |
| 55 | + exclude: | ||
| 56 | + - '@node-core/doc-kit' | ||
| 55 | 57 | commit-message: | |
| 56 | 58 | prefix: tools | |
| 57 | 59 | open-pull-requests-limit: 10 | |
0 commit comments