From 4c80dd356b8a61f80a35cdea80445087323f3f2c Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 10 Nov 2026 20:47:09 +0000
Subject: [PATCH] chore(deps): wait 14 days before proposing dependency
 upgrades

Renovate (minimumReleaseAge) and Dependabot (cooldown) now open an
upgrade Pull Request only once the release is 14 days old, so a
compromised version has time to be detected and pulled.

Security fixes are not delayed: Renovate vulnerability alerts have no
minimum release age, and Dependabot cooldown only applies to version
updates, not to security updates.
---
 renovate.json | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/renovate.json b/renovate.json
index 51b089c..8d94c48 100644
--- a/renovate.json
+++ b/renovate.json
@@ -1,6 +1,11 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": ["config:recommended"],
+  "minimumReleaseAge": "14 days",
+  "internalChecksFilter": "strict",
+  "vulnerabilityAlerts": {
+    "minimumReleaseAge": null
+  },
   "packageRules": [
     {
       "matchUpdateTypes": ["minor", "patch"],