From c52e15143950c67c2ecbe99f5e0aded159b3a74f Mon Sep 17 00:00:00 2001
From: Wei Liu <liuwe@microsoft.com>
Date: Tue, 31 Mar 2026 06:05:14 +0000
Subject: [PATCH] github: Introduce cool down periods for non-rust-vmm crates

This gives the community more time to react to possible security chain
compromises.

We have high confidence that rust-vmm crates are trusted, and the
community is fully capable of spotting any issues. There is no need to
delay that group.

Signed-off-by: Wei Liu <liuwe@microsoft.com>
---
 .github/dependabot.yml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 781912648..2f3865fb1 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -37,6 +37,11 @@ updates:
     interval: weekly
   allow:
     - dependency-type: all
+  cooldown:
+    default-days: 7
+    semver-major-days: 14
+    semver-minor-days: 7
+    semver-patch-days: 3
   ignore:
     - dependency-name: "acpi_tables"
     - dependency-name: "kvm-bindings"