From b67a85be5f8f65403bb6cecf823ede188682b57b Mon Sep 17 00:00:00 2001
From: Chris Sinjakli <sinjo@planetscale.com>
Date: Thu, 9 Apr 2026 11:27:54 +0100
Subject: [PATCH] chore(dependencies): add 14 day dependency cooldown to
 Dependabot config

As a mitigation against supply-chain attacks, we're adopting a 14 day
cooldown on dependency updates. This covers a lot of the supply chain
attacks via compromised dependencies that have been seen in the wild so
far, where the compromised version is only available for less than a
day.

This isn't perfect, or the whole story, but it's a good next step for us
to take.
---
 .github/dependabot.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 275639b..a0d8554 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -9,3 +9,5 @@ updates:
       include: scope
     schedule:
       interval: daily
+    cooldown:
+      default-days: 14