From 7e784f80f6c1ff8ba749eb4e4feee1c705c123fa Mon Sep 17 00:00:00 2001
From: Frank Elsinga <frank@elsinga.de>
Date: Fri, 17 Oct 2025 22:16:39 +0200
Subject: [PATCH] chore(ci): apply dependency cooldowns (#1431)

add a cooldown to dependency updates to give the securiy communtiy a
better chance of fixing supply chain attacks
---
 .github/dependabot.yml | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 8011837d..b32bd178 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -11,7 +11,22 @@ updates:
       interval: "daily"
     open-pull-requests-limit: 20
     versioning-strategy: increase
+    cooldown:
+      default-days: 5
+      semver-major-days: 5
+      semver-minor-days: 3
+      semver-patch-days: 3
+      include:
+        - "*"
+      exclude:
+        - "@maplibre/*"
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: "daily"
+    cooldown:
+      default-days: 3
+      # no semver support for github-actions
+      # => no specific configuration for this
+      include:
+        - "*"