From 606d6648a072f0de2dd468c9539cd05e06db338d Mon Sep 17 00:00:00 2001 From: Conduction Release Bot Date: Mon, 17 Aug 2026 10:00:53 +0200 Subject: [PATCH] chore(deps): add composer cooldown to dependabot.yml Composer had no package-ecosystem entry at all, so composer dependencies got no release-age cooldown whatsoever, unlike npm which has had one for a while. Adds cooldown.default-days: 2 with a conduction/* exclude, matching the fleet-wide floor gate-93 (composer-cooldown-config) enforces. See ConductionNL/hydra openspec/changes/composer-dependency-cooldown and ADR-093 (proposed, ConductionNL/hydra#591). --- .github/dependabot.yml | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 3390c9e54..d33d37d06 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -11,3 +11,28 @@ updates: - "*" exclude: - "@conduction/*" + + # Composer had NO entry at all, so PHP dependencies were updated with no + # cooldown whatsoever — the window in which a compromised release is still + # published is exactly the window an instant update walks into. `npm` above + # has had one for a while; composer was simply never added, which is not a + # decision anyone made. + # + # Two days rather than one: that is the floor gate-93 enforces, and the npm + # entry's single day predates it. + # + # Our own packages are excluded from the wait on purpose. A cooldown protects + # against a compromised upstream release; `conduction/*` comes from this + # fleet's own CI, and delaying it would only slow the loop between a fix + # being released here and arriving here. + - package-ecosystem: "composer" + directory: "/" + schedule: + interval: "weekly" + open-pull-requests-limit: 10 + cooldown: + default-days: 2 + include: + - "*" + exclude: + - "conduction/*"