mirror of
https://github.com/outbackdingo/firezone.git
synced 2026-01-27 10:18:54 +00:00
852a7a9484
Configure Dependabot with a 28-day cooldown period across all package ecosystems to protect against supply-chain attacks. This ensures newly released packages undergo community vetting before adoption. Key changes: - Add 7-day cooldown for all dependency types (major, minor, patch) - Switch from monthly to weekly checks to ensure timely updates after cooldown expires - Use YAML anchors to maintain DRY configuration (we can unfold them if we need custom config) Security rationale: - Most supply-chain attacks are discovered within a few days of release - Patch versions are particularly vulnerable as they're often auto-merged with less scrutiny - Weekly checks + 28-day cooldown = roughly matching previous elixir dependency update cadence Note: Security updates bypass the cooldown and are applied immediately, ensuring critical CVEs are patched without delay