chore(deps): skip the Dependabot cooldown for packages this org publishes

[shenxianpeng]

Why

Since 2026-07-14 Dependabot applies a 3-day cooldown to version updates by default (changelog). cpp-linter 1.14.0 reached PyPI on 2026-09-13 22:05 UTC; the uv jobs on 09-13, 09-14 and 09-15 all logged Filtered out 1 versions due to cooldown for it and left the pin at 1.13.0.

The cooldown exists to give third-party releases time to be vetted. cpp-linter and clang-tools are published by this org, so the wait only delays our own release train.

What

cooldown on the uv ecosystem with default-days: 3 (the platform default, now explicit) and exclude: [cpp-linter, clang-tools]. exclude takes precedence, so those two update on the next run after a release; everything else keeps the 3-day wait (options reference).

Merging triggers a Dependabot run; it should open the 1.13.0 → 1.14.0 bump in the org group right away.

Summary by CodeRabbit

• Chores
  • Updated dependency update scheduling with a three-day cooldown by default.
  • Excluded select tooling packages from the cooldown.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 243db5f5-95ce-4ee6-8ac4-4d9023c057ea

📥 Commits

Reviewing files that changed from the base of the PR and between dacf512 and 838c1cc.

📒 Files selected for processing (1)

• .github/dependabot.yml

Included review availability: Your plan provides up to 2 included reviews per hour; 1 remains after this review.

---

Walkthrough

The Dependabot uv configuration adds a three-day default cooldown and excludes cpp-linter and clang-tools.

Changes

Dependabot cooldown

Layer / File(s)	Summary
Configure uv update cooldown .github/dependabot.yml	Adds a three-day default cooldown for uv updates. Excludes cpp-linter and clang-tools from the cooldown.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to 838c1

The Dependabot configuration matches the intended cooldown and package exclusions, with no identified merge-blocking risk.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: it skips the Dependabot cooldown for organization-published packages.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[shenxianpeng]

I will wait for Dependabot to bump cpp-linter to the latest version, but I have to wait for 3 days by default.

So I would like to think about excluding our published package from the cooldown section.