GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — Add a cooldown period to dependabot by gpshead · Pull Request #141866 · python/cpython

Conversation

@gpshead

@gpshead gpshead commented Nov 23, 2025

Copy link
Copy Markdown
Member

The rational of this practice is well laid out in https://blog.yossarian.net/2025/11/21/We-should-all-be-using-dependency-cooldowns.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@gpshead
[security] Add a cooldown period to dependabot
6c4545d 
https://blog.yossarian.net/2025/11/21/We-should-all-be-using-dependency-cooldowns
@gpshead
gpshead requested a review from sethmlarson November 23, 2025 02:29
@gpshead
gpshead requested review from AA-Turner, ezio-melotti and hugovk as code owners November 23, 2025 02:30
@bedevere-app bedevere-app Bot added the awaiting core review label Nov 23, 2025
@gpshead gpshead added skip issue skip news and removed awaiting core review labels Nov 23, 2025
AA-Turner
AA-Turner reviewed Nov 23, 2025
View reviewed changes

@AA-Turner AA-Turner left a comment •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We already have a monthly interval, so E[dependency updated] is a fortnight. As such I think 14 days might be overkill?

A

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
Comment thread .github/dependabot.yml Resolved

Uh oh!

There was an error while loading. Please reload this page.
Comment thread .github/dependabot.yml Resolved

Uh oh!

There was an error while loading. Please reload this page.
Comment thread .github/dependabot.yml Resolved

Uh oh!

There was an error while loading. Please reload this page.
@AA-Turner AA-Turner added the type-security A security issue label Nov 23, 2025
@AA-Turner AA-Turner changed the title [security] Add a cooldown period to dependabot Add a cooldown period to dependabot Nov 23, 2025
@gpshead

gpshead commented Nov 23, 2025

Copy link
Copy Markdown
Member Author

The monthly schedule is not a cooldown. A security cooldown means not auto-updating to a dep until that long after it's release.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
gpshead added 2 commits November 23, 2025 02:40
@gpshead
old-man-yells-at-yaml
d997923
@gpshead
add direct description to not rely on blog
4904a6e
@gpshead

gpshead commented Nov 23, 2025

Copy link
Copy Markdown
Member Author

fixed up. i'm leaving it as 14d because with our existing monthly schedule we're already not trying to get new versions fast anyways. whenever there is an actual urgent need we'll already be making our own PR, so i'm opting to move slower by default.
AA-Turner reacted with thumbs up emoji
All reactions
  • 👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
AA-Turner
AA-Turner approved these changes Nov 23, 2025
View reviewed changes
@bedevere-app bedevere-app Bot added the awaiting merge label Nov 23, 2025
emmatyping
emmatyping approved these changes Nov 23, 2025
View reviewed changes
@gpshead
gpshead merged commit 2746c69 into python:main Nov 23, 2025
46 checks passed

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the awaiting merge label Nov 23, 2025
@gpshead
gpshead deleted the dependabot-cooldowns branch November 23, 2025 09:34
@hugovk hugovk mentioned this pull request Nov 27, 2025
Add zizmor to CI and fix findings python/python-docs-theme#283
Merged
StanFromIreland pushed a commit to StanFromIreland/cpython that referenced this pull request Dec 6, 2025
@gpshead @StanFromIreland
[security] Add a cooldown period to dependabot (pythonGH-141866)
351421b 
See https://blog.yossarian.net/2025/11/21/We-should-all-be-using-dependency-cooldowns and the description in the comment.
ashm-dev pushed a commit to ashm-dev/cpython that referenced this pull request Dec 8, 2025
@gpshead @ashm-dev
[security] Add a cooldown period to dependabot (pythonGH-141866)
1b6b257 
See https://blog.yossarian.net/2025/11/21/We-should-all-be-using-dependency-cooldowns and the description in the comment.
@hugovk hugovk mentioned this pull request Dec 23, 2025
[3.14] Update pre-commit with zizmor and Ruff fixes (GH-143095) #143102
Merged
This was referenced Feb 28, 2026
Add cooldown to Dependabot python/cherry-picker#174
Merged
Dependabot: add cooldown, reduce interval to monthly python/python-insider-blog#10
Merged
@hugovk hugovk mentioned this pull request May 27, 2026
Add zizmor to pre-commit and fix findings python/devguide#1812
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@AA-Turner AA-Turner AA-Turner approved these changes
@emmatyping emmatyping emmatyping approved these changes
@sethmlarson sethmlarson Awaiting requested review from sethmlarson
@ezio-melotti ezio-melotti Awaiting requested review from ezio-melotti ezio-melotti is a code owner
@hugovk hugovk Awaiting requested review from hugovk hugovk is a code owner

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

skip issue skip news type-security A security issue

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

3 participants

@gpshead @AA-Turner @emmatyping
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.