Take our own releases past Dependabot's three-day wait

Merged
AL
5h ago
+12-0

Closes #9.

The daily npm update job has failed since 2026-11-09. Dependabot holds new versions back three days and runs pnpm with --config.minimum-release-age=4320, and pnpm then refuses every locked version younger than that. This site pins @missing-elements releases on the day they come out, so the job failed after each one.

  • pnpm-workspace.yaml (new, settings only): minimumReleaseAgeExclude: ["@missing-elements/*"], so pnpm's age check passes our own releases.
  • .github/dependabot.yml: cooldown keeps the three days for every other package and excludes ours, so a release of ours gets its PR the same day.

Checked locally with Dependabot's own command, pnpm update @11ty/eleventy@3.1.8 --lockfile-only --config.minimum-release-age=720. Without the file it fails on h5p-author 0.6.0; with it, it passes. A 12-hour age is used because the three-day one still trips on third-party versions (below). pnpm install --frozen-lockfile is unchanged.

Not fixed by this: the job stays red until about 2026-11-13. rolldown 1.2.18 and a few other third-party versions locked on 2026-11-10 are younger than three days, which only time settles.

Summary by cubic

Fixes #9. The daily npm update job has failed since 2026-11-09 because Dependabot holds new versions back three days and pnpm refuses locked versions younger than that, while this site pins @missing-elements releases on release day. Excludes @missing-elements/* from the age check in pnpm and Dependabot so our releases get PRs the same day.

  • Adds minimumReleaseAgeExclude in new pnpm-workspace.yaml.
  • Adds a cooldown in .github/dependabot.yml: three days for all other packages, none for ours.

Not fixed by this: the job stays red until about 2026-11-13; third-party versions locked on 2026-11-10 are still under three days old.