From 3ee465e12b815a191d902856440e2f3348bda506 Mon Sep 17 00:00:00 2001
From: Jordan Mecom <jm@squareup.com>
Date: Thu, 20 Aug 2026 12:26:53 -0700
Subject: [PATCH] Enforce a three-day dependency cooldown (#6426)

Configure Renovate to wait three days before proposing newly released
dependencies.

The policy requires a registry publication timestamp and suppresses
branches until the release ages past the window. Renovate security-alert
updates continue to bypass minimum-release-age checks, so known fixes
are not delayed.

Checked with `renovate-config-validator --strict --no-global
renovate.json`, `jq`, and `git diff --check`.

Signed-off-by: Jordan Mecom <jm@squareup.com>
---
 renovate.json | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/renovate.json b/renovate.json
index dfc3ed4eae..e827ca8a5a 100644
--- a/renovate.json
+++ b/renovate.json
@@ -1,6 +1,9 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": ["config:recommended", "helpers:pinGitHubActionDigests"],
+  "minimumReleaseAge": "3 days",
+  "minimumReleaseAgeBehaviour": "timestamp-required",
+  "internalChecksFilter": "strict",
   "prCreation": "immediate",
   "automerge": true,
   "rebaseWhen": "conflicted",