Add cooldown periods to Dependabot configuration
org.openrewrite.github.AddDependabotCooldownorg.openrewrite.recipe:rewrite-github-actionsAdds a cooldown section to each update configuration in Dependabot files. Supports default-days, semver-major-days, semver-minor-days, semver-patch-days, include, and exclude options. This implements a security best practice where dependencies are not immediately adopted upon release, allowing time for security vendors to identify potential supply chain compromises. Cooldown applies only to version updates, not security updates. Read more about dependency cooldowns. The available configuration options for dependabot are listed on GitHub.
Usage
This recipe has no required configuration options. You’ll need the Moderne CLI configured before running the command below.
mod run . --recipe org.openrewrite.github.AddDependabotCooldownIf the recipe isn’t available locally, install it with:
mod config recipes jar install org.openrewrite.recipe:rewrite-github-actions:3.28.0Options
| Name | Type | Description |
|---|---|---|
cooldownDays | Integer | The number of days to wait before considering a published dependency suitable for use (1-90). This delay allows security vendors time to identify potential compromises. Applied to all version types unless specific semver options are set. e.g. 7 |
semverMajorDays | Integer | The number of days to wait for major version updates (1-90). Only applies to package managers that support semantic versioning. e.g. 14 |
semverMinorDays | Integer | The number of days to wait for minor version updates (1-90). Only applies to package managers that support semantic versioning. e.g. 7 |
semverPatchDays | Integer | The number of days to wait for patch version updates (1-90). Only applies to package managers that support semantic versioning. e.g. 3 |
include | List | List of up to 150 dependencies to apply cooldown to. Supports wildcard patterns with *. If not specified, cooldown applies to all dependencies.e.g. lodash, react* |
exclude | List | List of up to 150 dependencies to exempt from cooldown. Supports wildcard patterns with *. Exclude list takes precedence over include list.e.g. critical-security-package |
excludeEcosystems | List | List of ecosystems to be excluded e.g. github-actions |
Data tables
Structured output this recipe can produce.
- Source files that had resultsSource files that were modified by the recipe run.
org.openrewrite.table.SourcesFileResults - Source files that had search resultsSearch results that were found during the recipe run.
org.openrewrite.table.SearchResults - Source files that errored on a recipeThe details of all errors produced by a recipe run.
org.openrewrite.table.SourcesFileErrors - Recipe performanceStatistics used in analyzing the performance of recipes.
org.openrewrite.table.RecipeRunStats