[AchoArnold]

Goal

Avoid routine npm version-update PRs that immediately fail pnpm's 24-hour release-age guard, including fresh transitive packages pulled in while regenerating the lockfile.

Changes

• Declare a three-day cooldown for /web npm version updates.
• Set minimumReleaseAge: 1440 in web/pnpm-workspace.yaml so pnpm 10.16+ used by Dependabot inherits the same 24-hour guard as local pnpm 11, rather than relying on pnpm 11's implicit default.
• Preserve monthly schedules, Go and Actions policies, build-script whitelist, local hooks and CI installation behavior. No dependencies or lockfile entries changed.

Why both settings

GitHub currently documents a three-day default cooldown even without configuration: declaring it alone is not the fix. The explicit workspace setting is the substantive change: pnpm applies it during dependency resolution, including transitive packages. Current Dependabot code reads the native setting and applies the longer cooldown/native window during regular pnpm updates.

Limits

• Security updates bypass Dependabot's cooldown and its native release-age override so urgent fixes are not delayed. The local guard is unchanged and can still reject such a PR until packages mature.
• This is not an absolute guarantee: enforcement depends on the deployed Dependabot/pnpm versions (native age support requires pnpm 10.16+). Non-strict resolver fallback when no mature version exists, missing publication metadata, or pre-existing young lockfile entries can still cause a local rejection. Platform-specific exact dependencies are one such edge case.
• Existing PRs fix(deps): bump nuxt from 4.6.2 to 4.6.3 in /web #1056 and fix(deps): bump re2js from 2.8.6 to 2.9.1 in /web #1057 are not repaired or merged by this policy change. Heartbeat PR fix(api): expire MongoDB heartbeats after 60 days #1058 and its files are untouched.

Verification

• Parsed both YAML files using the existing installed YAML parser, rejecting duplicate keys.
• Asserted that all prior Dependabot configuration and workspace settings remain identical, excluding the two added policy keys.
• Targeted Prettier checks and git diff main...HEAD --check passed.
• pnpm config get minimumReleaseAge returned 1440 on installed pnpm 11.3.0.
• Normal pre-commit and commit-msg hooks passed; no guard or hook was bypassed.
• Confirmed the committed diff contains only the two config files and no lockfile changes. A hosted Dependabot run has not been exercised locally.

References

• GitHub cooldown options and security exception
• pnpm minimumReleaseAge
• Current Dependabot pnpm lockfile gate implementation
• Fixed native-gate/strict-mode compatibility issue

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge.

Summary

Adds a three-day Dependabot cooldown for /web npm updates and explicitly sets pnpm’s release-age guard to 1,440 minutes.

• Routine web updates wait for package versions to age before Dependabot proposes them.

_{Reviews (1) · Last reviewed commit: "fix(deps): align Dependabot updates with..." · Reviewed by Greptile}

[Copilot]

🟢 Approval recommended

No active review issues are identified for the web dependency-update policy changes.

No open issues 🎉

What changed in this PR

Aligns routine Dependabot updates for the web frontend with pnpm’s 24-hour release-age guard, reducing update PRs that fail local installation checks.

Changes:

• Declares a three-day cooldown for /web npm version updates.
• Explicitly sets pnpm’s release-age guard to 1,440 minutes so compatible Dependabot resolvers also apply it to transitive dependencies.
• Leaves monthly schedules, other ecosystem policies, build permissions, dependencies, and lockfiles unchanged.

File	Description
web/​pnpm-workspace.yaml	Adds the explicit 24-hour pnpm release-age setting.
.github/​dependabot.yml	Adds a three-day cooldown for web npm version updates.

_{Review effort: Balanced}