# Dependency update PRs wait out the same 7-day cooldown that .npmrc's
# min-release-age enforces locally. Security-advisory PRs are exempt
# from cooldown by design, so CVE fixes still arrive promptly.
version: 2
updates:
- package-ecosystem: npm
directory: /
schedule:
interval: weekly
cooldown:
default-days: 7
open-pull-requests-limit: 5
- package-ecosystem: uv
directory: /prime-agent-runtime
schedule:
interval: weekly
cooldown:
default-days: 7
- package-ecosystem: github-actions
directory: /
schedule:
interval: weekly
cooldown:
default-days: 7