security: Delay dependabot updates [TAROT-3707]

[afsmeira]

7 days should be enough when most malicious packages are patched within 24 hours.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[codacy-production]

Pull Request Overview

This PR fails to meet its core objective of delaying npm updates because it uses an unsupported cooldown key in .github/dependabot.yml. According to the GitHub Dependabot v2 schema, there is no native property to delay updates by a specific number of days after release. Consequently, this configuration will be ignored or cause a validation error, leaving the repository's security posture unchanged. This is a blocker for merging as the intended functionality is not operational.

About this PR

• The objective to mitigate the risk of 'day-zero' malicious packages by delaying updates is valid; however, the cooldown property does not exist in the Dependabot configuration schema. Without a valid implementation, this PR does not satisfy the requirement to delay updates.

Test suggestions

• Verify .github/dependabot.yml configuration against the GitHub Dependabot v2 schema.

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Verify .github/dependabot.yml configuration against the GitHub Dependabot v2 schema.

_{TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback}