Problem
zizmor `dependabot-cooldown` (GitHub alerts 45 and 46) flags both Dependabot ecosystems. Dependabot's implicit cooldown is 3 days; zizmor wants at least 7 so a yanked/compromised release is less likely to land in an automatic PR.
What this issue covers
- `cooldown.default-days: 7` on the nuget and github-actions updaters in `.github/dependabot.yml`.
Acceptance
- Both updaters declare a 7-day cooldown.
- Alerts 45 and 46 close after the next zizmor run.
Problem
zizmor `dependabot-cooldown` (GitHub alerts 45 and 46) flags both Dependabot ecosystems. Dependabot's implicit cooldown is 3 days; zizmor wants at least 7 so a yanked/compromised release is less likely to land in an automatic PR.
What this issue covers
Acceptance