[alexandreferris]

---

PR Submission Checklist for internal contributors

• The PR Title

  • conforms to the style of semantic commits messages¹ supported in Wire's Github Workflow²
  • contains a reference JIRA issue number like SQPIT-764
  • answers the question: If merged, this PR will: ... ³

• The PR Description

  • is free of optional paragraphs and you have filled the relevant parts to the best of your ability

---

What's new in this PR?

Issues

Dependabot runs weekly, creating unnecessary noise on small updates

Solutions

• Change interval to monthly
• Add cooldown of 7 days for new releases

[claude]

PR Review — Update dependabot interval (WPB-26814)

Thanks for this cleanup! The change is small, focused, and directly addresses the stated problem of weekly Dependabot noise. Overall it looks good to merge — a few notes below.

✅ What works well

• interval: monthly — valid value and a sensible way to cut down on PR noise for small updates.
• cooldown / default-days: 7 — correct placement (sibling of schedule at the update-entry level) and default-days is a valid key. Combining a 7-day cooldown with a monthly cadence is a reasonable way to skip brand-new releases that may still get patched or yanked.
• Applied consistently to both the gradle and github-actions ecosystems.

💡 Suggestions (non-blocking)

1. Security updates cadence. interval and cooldown only affect version update PRs. Dependabot security updates are unaffected and will still be raised promptly, so moving to monthly does not delay CVE fixes — worth confirming this matches the team expectation.
2. Consider groups. Since the goal is reducing noise, grouping updates (a groups: block per ecosystem) is often even more effective than lengthening the interval: it collapses many small bumps into a single PR while keeping the cadence tight. Optional, but complements this change nicely.
3. Pre-existing nit (not introduced here): the Maven updates comment sits above the gradle ecosystem block — slightly misleading. Cheap to fix while you are in the file.

🔒 Security / 🏎️ Performance / 🧪 Tests

• No security concerns — this is CI/CD dependency-management config, and (per note 1) security updates are not throttled.
• No performance impact.
• No tests apply to a Dependabot config file; nothing needed here.

Nice, clean change. 👍