version-updates

GitHub's Dependabot now defaults to a three-day cooldown before opening version update pull requests, requiring no configuration.

Dependabot now waits three days before opening version update PRs to reduce risk of supply chain attacks. Security updates remain immediate.