From 224b0d14463c962f63ae1fb40ca0aa336379178e Mon Sep 17 00:00:00 2001
From: Acho Arnold Ewin <arnold@ndolestudio.com>
Date: Sun, 1 Nov 2026 15:04:48 +0200
Subject: [PATCH] fix(deps): align Dependabot updates with pnpm release-age
 guard

Declare a three-day npm cooldown and share the existing 24-hour release-age gate
with Dependabot's pnpm resolver. Keep monthly schedules and security updates unchanged.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: f27d8f52-9620-4ee2-a564-ec4870a5f840
---
 .github/dependabot.yml  | 4 ++++
 web/pnpm-workspace.yaml | 2 ++
 2 files changed, 6 insertions(+)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 13fcccb3a..26bbbb041 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -6,6 +6,10 @@ updates:
     schedule:
       interval: monthly
       time: "00:00"
+    # Keep version updates beyond pnpm's 24-hour release-age guard.
+    # Security updates bypass cooldown; transitive resolution also needs the workspace gate.
+    cooldown:
+      default-days: 3
     open-pull-requests-limit: 10
     reviewers:
       - AchoArnold
diff --git a/web/pnpm-workspace.yaml b/web/pnpm-workspace.yaml
index 391a8baf8..816d7767e 100644
--- a/web/pnpm-workspace.yaml
+++ b/web/pnpm-workspace.yaml
@@ -5,3 +5,5 @@ allowBuilds:
   protobufjs: true
   unrs-resolver: true
   vue-demi: true
+# Share pnpm's 24-hour guard with Dependabot's resolver, including pnpm 10.16+.
+minimumReleaseAge: 1440