Conversation
Since 2026-07-14 GitHub applies a 3-day cooldown to version updates even when cooldown is unset, which holds updates back longer than this repo wants. Both entries now pin default-days: 1, the minimum the option accepts, so updates land sooner while still clearing the 24h minimumReleaseAge gate in pnpm-workspace.yaml. The default open-pull-requests-limit of 5 was stalling the queue: the github-actions entry has been sitting at exactly 5 open PRs since 2026-08-07 with nothing new raised since. Raising it to 100 effectively removes the cap. Security update PRs were never subject to it.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Advanced Run ID: 📒 Files selected for processing (1)
Included review availability: Your plan provides up to 2 included reviews per hour; 1 remains after this review. 📜 Recent review details⏰ Context from checks skipped due to timeout. (308)
🔇 Additional comments (1)
WalkthroughThe Dependabot configuration adds a one-day cooldown and a 100-open-pull-request limit to npm and GitHub Actions updates. ChangesDependabot update configuration
Estimated code review effort: 1 (Trivial) | ~2 minutes Merge Risk: ⚪ Minimal · up to Dependabot will use a one-day cooldown and allow up to 100 open update pull requests for npm and GitHub Actions. No merge-blocking risk remains. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
✨ Simplify code
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Code Coverage OverviewLanguages: TypeScript TypeScript / code-coverage/arkorThe overall line coverage in commit dff802e in the TypeScript / code-coverage/create-arkorThe overall line coverage in commit dff802e in the TypeScript / code-coverage/cli-internalThe overall line coverage in commit dff802e in the TypeScript / code-coverage/studio-appThe overall line coverage in commit dff802e in the Updated |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
Contributor
 |
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
soleil-colza
self-requested a review
September 10, 2026 12:07
soleil-colza
approved these changes
Sep 10, 2026
This was referenced Sep 19, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two Dependabot options, one per the request in ENG-1153: a 1-day
cooldownandopen-pull-requests-limit: 100, applied to both update entries.Why
open-pull-requests-limit. The default is 5 per ecosystem, and thegithub-actionsentry has been sitting at exactly that since 2026-08-07 (#207, #209, #218, #219, #220), with no new Actions PR raised since. The npm side is in the same shape. Raising the limit to 100 effectively removes the cap; the docs describe that as the supported way to do it ("A large value can be set to effectively remove the open pull request limit"). Security update PRs were never subject to this limit and do not count toward it.cooldown. Worth being precise about the direction here, because it is the opposite of what the option name suggests at a glance. Since 2026-07-14 Dependabot applies a 3-day cooldown to version updates even whencooldownis not configured. So this is not "add a cooldown where there was none": it shortens the effective window from 3 days to 1.The 1-day floor is not arbitrary.
pnpm-workspace.yamlsetsminimumReleaseAge: 1440(24 h) as a supply-chain guard, so a version younger than that is one pnpm refuses to resolve anyway.default-days: 1is the shortest window that still clears that gate, and it is also the minimum the option accepts (the schema boundsdefault-daysto 1..90).Changes
.github/dependabot.yaml, 6 added lines, nothing else in the repo touched:added to both the
npmand thegithub-actionsentry. The existingschedule: weeklyand the@types/nodesemver-majorignorerule are unchanged.Verification
dependabot-2.0.json(jsonschema.validate, VALID). That schema setsadditionalProperties: falseon the update object, so an unknown key would have failed;default-daysis boundedminimum: 1, maximum: 90, andopen-pull-requests-limitisminimum: 0with no maximum.cooldownis supported forgithub-actions. This one is easy to get wrong: a summary of the docs page told me GitHub Actions was absent from the cooldown support table. Reading the docs source directly (dependabot-options-reference.mdL252) shows the opposite: the Actions row isdefault-dayssupported,semver-*-daysnot supported. Onlydefault-daysis used here.dependabot.yml; this repo uses.yaml. It is read: the@types/nodeignore rule landed 2026-05-26 and Actions version-update branches kept appearing through 2026-07-24.yaml.safe_load), andgit diff mainis the 6 lines above.Not run:
pnpm build/typecheck/test. No runtime surface is involved.pnpm format:checkdoes not apply either, since oxfmt'signorePatternsexcludes**/*.yaml.Notes
dependabotis not referenced anywhere else in the repo (docs, CONTRIBUTING, workflows all clean), so there is no English/Japanese pair to keep in sync.schedule: weeklyand the cap lifted, the backlog that the limit of 5 was holding back will open at once, and this repo's CI is an OS x Node matrix plus Playwright. That is the intended effect of the change, but it is worth knowing before the next check runs.minimumReleaseAgecorrespondence, deliberately: the file is kept minimal, and the reasoning lives here and in the commit message.Summary by CodeRabbit
Summary by cubic
Shortens Dependabot's cooldown from the 3-day default to 1 day and raises the open PR limit from 5 to 100 for both
npmandgithub-actionsupdates.minimumReleaseAgegate inpnpm-workspace.yaml.Written for commit dff802e. Summary will update on new commits.