[anupamme]

Summary

Add a 7-day Dependabot cooldown before newly released dependency versions are proposed for update.

Why

A short cooldown gives maintainers time to notice potentially malicious, compromised, or unstable dependency releases before they're automatically proposed for adoption. This is a dependency-management hardening measure, not a fix for a demonstrated runtime vulnerability in node-minecraft-data.

Changes

• Add a 7-day Dependabot cooldown (.github/dependabot.yml).
• No application/runtime code is changed.
• No new runtime dependencies are introduced.

Impact

Dependency updates may be proposed up to 7 days after a new version is released — trading some update freshness for extra review time around newly published versions.

Testing

No application-level test is required; this change only modifies Dependabot configuration and can be reviewed directly as YAML.

[extremeheat]

@codex review

[rom1504]

Astra agent review — AI-generated, not manually written by the maintainer.

This is a dependency-update cadence choice for maintainers, not an established high-severity runtime vulnerability. The actual diff adds a seven-day cooldown to Dependabot; it does not repair a demonstrated package execution path. Decide whether that delay fits the repository’s update policy, and describe the change accordingly.

I found no independent code defect in the small configuration edit. No runtime test is warranted for the scanner’s illustrative JavaScript assertion of its own policy.

Skills used: prismarine-review checked the actual diff against the security claim; prismarine-architecture-review separated repository automation policy from the published library API.

[anupamme]

Thanks for the review — agreed that I overstated the security impact in the original description.

I've reframed this as a dependency-management hardening change rather than a HIGH-severity vulnerability fix:

• removed the HIGH severity / security-vulnerability claims from the title and description
• removed the embedded JS/YAML regression test (no test file was ever committed, and no js-yaml dependency was added)
• kept only the 7-day Dependabot cooldown configuration change
• updated the description to explain the freshness-vs-review-time trade-off

The PR now only modifies .github/dependabot.yml.