From 439f58b8803d71aeca9c2b3a914c6faef6f43921 Mon Sep 17 00:00:00 2001 From: Aleksandr Shevchuk Date: Tue, 10 Nov 2026 10:00:38 +0200 Subject: [PATCH] fix: take our own releases past Dependabot's three-day wait Dependabot holds new versions back three days and runs pnpm with that minimum release age, which refuses any locked version younger than it, so a weekly npm run within three days of one of our releases failed. Those are left out of the age in pnpm-workspace.yaml and in Dependabot's cooldown; other packages keep it. Closes #19 --- .github/dependabot.yml | 5 +++++ pnpm-workspace.yaml | 7 +++++++ 2 files changed, 12 insertions(+) create mode 100644 pnpm-workspace.yaml diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 257d592..963ebb4 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -12,3 +12,8 @@ updates: groups: dev: dependency-type: development + # New versions wait three days, but ours are taken as they are released: they are what this + # origin serves. pnpm-workspace.yaml leaves them out of pnpm's age check to match (#19). + cooldown: + default-days: 3 + exclude: ["@missing-elements/*"] diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml new file mode 100644 index 0000000..d9f2302 --- /dev/null +++ b/pnpm-workspace.yaml @@ -0,0 +1,7 @@ +# pnpm settings for this site, which is one package, not a workspace. +# +# Dependabot holds every new version back three days and runs pnpm with that minimum release age, +# which then refuses any locked version younger than it. The site pins @missing-elements releases +# as they come out, so they are left out of the age; every other package keeps it (#19). +minimumReleaseAgeExclude: + - "@missing-elements/*"