From 2d4139b6d0b113c84ab41d6ddc9e645e38cedbf7 Mon Sep 17 00:00:00 2001 From: "Michael A. Smith" Date: Tue, 29 Sep 2026 12:12:13 -0400 Subject: [PATCH] ci(dependabot): update openCoreEMR packages without the release cooldown Dependabot now holds every version update for 3 days after release unless dependabot.yml configures a cooldown. The delay guards against a compromised third-party release, but it only slows down our own: an internal release sat unproposed until the window passed. Exclude openCoreEMR packages (both name casings, since GitHub Actions and Composer spell the owner differently) and keep the 3-day default for everything else. Assisted-by: Claude Code --- .github/dependabot.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 75294c3..4b01723 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,6 +1,10 @@ version: 2 updates: - package-ecosystem: github-actions + cooldown: + exclude: + - openCoreEMR/* + - opencoreemr/* directory: / schedule: interval: daily