3 Commits

Include renames

Author	SHA1	Message	Date
William Woodruff	42bafdadf9	Add dependency cooldowns (#1021) ... This does two things: - Bumps our Dependabot-side cooldowns to 30d - Adds an NPM-side 7d cooldown The idea is to give automated cooldowns a longer period, whereas humans doing maintenance/manual bumps can opt into a newer package as needed. --- <sub>Stack created with <a href="https://github.com/github/gh-stack">GitHub Stacks CLI</a> • <a href="https://gh.io/stacks-feedback">Give Feedback 💬</a></sub>	2026-08-16 21:41:43 +02:00
William Woodruff	64f7f4e15f	chore: use npm ci --ignore-scripts everywhere (#699) ... Like https://github.com/astral-sh/ruff-action/pull/276 🙂 This also adds cooldown stanzas to the Dependabot updater rules: this ensures that we only receive dependency bumps once they're at least a week old, which should reduce the window of opportunity for an attacker who temporarily compromises popular packages (like with "Shai-Hulud" last week). Signed-off-by: William Woodruff <william@astral.sh>	2025-12-02 08:08:49 +01:00
Kevin Stillhammer	18498fc78f	Initial commit	2024-08-23 23:58:26 +02:00