Add dependabot.yml for automated weekly updates with cooldown delays

[Shurtu-gal]

I'd like to propose distributing a dependabot.yml configuration to improve our dependency update process and strengthen supply-chain security.

We could have a dependabot or another label for maintainers to opt into this.

Why

• Dependabot keeps dependencies updated automatically.
• The cooldown field is particularly useful—it adds a delay before Dependabot creates PRs, giving security researchers and maintainers time to assess upstream releases before we pull them in.
• This delay is valuable for mitigating supply-chain risks, such as those seen in recent npm incidents (e.g., compromised versions of chalk could have affected cli).

Proposed dependabot.yml

version: 2
updates:
  - package-ecosystem: "npm"
    directories:
      - "**/*"
    schedule:
      interval: "weekly"
    cooldown:
      default-days: 3
      semver-major-days: 7
      semver-minor-days: 5

Caution

Our organization uses multiple ecosystems across repositories (e.g., npm, pnpm). Either we can add all package-ecosystem in the same file or just focus on npm. Need some advice on this.

[derberg]

opt-in?
how about other package managers?

[Shurtu-gal]

opt-in?

We could have a dependabot or another label for maintainers to opt into this.

how about other package managers?
We could have multiple updates rules one for each ecosystem, I guess.

[derberg]

opt-in I mean that it is not rolled out to all repos but only those with specific topic

[Shurtu-gal]

Yeah, I mean the same, maybe we are having misunderstanding between label and topic 😅

[derberg]

yeah, technically its a topic

get-dependabot-nodejs ? and future can be easily extended. You can reach to owners for .NET and Java project we have here

[sammy200-ui]

@derberg @Shurtu-gal

i would like to say somethings , so dependabot doesn't automatically propagate from the org's .github repo to other repo , it must exist in each repo directory individually.

how about doing this - having a workflow that syncs dependabot to repos with a label , then we can document it on how the maintainer will adopt it.

also doesnt dependabot treats npm, pnpm, and yarn as the same ecosystem ?