Problem
Dependabot regularly proposes dependency versions faster than the Databricks JFrog registry (db-pypi / db-npm) will serve them, so the bump PRs fail CI on dependency install through no fault of the change itself. Two failures on the same day:
- #779 —
google-cloud-bigquery 3.41.0 → 3.45.0. The version isn't in the JFrog pip mirror yet (only ≤3.44.0 available). uv/pip resolution fails: No matching distribution found for google-cloud-bigquery==3.45.0. Breaks Requirements Lockfile Check, Alembic Single-Head Check, and Backend Tests (Coverage Report fails downstream on the missing artifact).
- #773 —
lucide-react 1.16.0 → 1.41.0. JFrog Curation blocks it under a 7-day immaturity cooldown ({7d-cooldown, Package version is immature 7d, Package version is 5 days old}): npm error code E403 ... 403 Forbidden.
Both are the same underlying issue: the registry needs time (mirror sync lag / a 7-day maturity cooldown) before a freshly published version is installable. Any bump to a release younger than ~7 days is liable to red-CI until the registry catches up.
Proposed fix
Add a cooldown setting to each updates entry in .github/dependabot.yml so Dependabot waits ~7 days after a release before opening the PR — matching the JFrog maturity window. This avoids both failure modes above.
version: 2
updates:
- package-ecosystem: "github-actions"
directory: "/"
schedule:
interval: "weekly"
cooldown:
default-days: 7
- package-ecosystem: "pip"
directory: "/src"
schedule:
interval: "weekly"
cooldown:
default-days: 7
# ...same `cooldown` block on the remaining pip (/src/backend, /src/e2e)
# and npm (/src/frontend, /website/ontos) entriescooldown supports finer knobs if we want them (semver-major-days, semver-minor-days, semver-patch-days, plus include/exclude package globs). 7 days across the board is the simplest match to the registry's behavior; we can lengthen major-version cooldowns later if desired.
Acceptance criteria
Notes
This reduces recurrence but doesn't fully eliminate it — mirror sync can occasionally lag beyond 7 days. Not in scope here, but a longer-term option is getting the JFrog mirror/curation policies aligned so needed versions are available promptly.
Problem
Dependabot regularly proposes dependency versions faster than the Databricks JFrog registry (
db-pypi/db-npm) will serve them, so the bump PRs fail CI on dependency install through no fault of the change itself. Two failures on the same day:google-cloud-bigquery3.41.0 → 3.45.0. The version isn't in the JFrog pip mirror yet (only ≤3.44.0 available).uv/pipresolution fails:No matching distribution found for google-cloud-bigquery==3.45.0. Breaks Requirements Lockfile Check, Alembic Single-Head Check, and Backend Tests (Coverage Report fails downstream on the missing artifact).lucide-react1.16.0 → 1.41.0. JFrog Curation blocks it under a 7-day immaturity cooldown ({7d-cooldown, Package version is immature 7d, Package version is 5 days old}):npm error code E403 ... 403 Forbidden.Both are the same underlying issue: the registry needs time (mirror sync lag / a 7-day maturity cooldown) before a freshly published version is installable. Any bump to a release younger than ~7 days is liable to red-CI until the registry catches up.
Proposed fix
Add a
cooldownsetting to eachupdatesentry in.github/dependabot.ymlso Dependabot waits ~7 days after a release before opening the PR — matching the JFrog maturity window. This avoids both failure modes above.cooldownsupports finer knobs if we want them (semver-major-days,semver-minor-days,semver-patch-days, plusinclude/excludepackage globs). 7 days across the board is the simplest match to the registry's behavior; we can lengthen major-version cooldowns later if desired.Acceptance criteria
cooldownadded to all sixupdatesentries in.github/dependabot.ymldefault-daysset to at least 7 (matching the JFrog curation immaturity window)Notes
This reduces recurrence but doesn't fully eliminate it — mirror sync can occasionally lag beyond 7 days. Not in scope here, but a longer-term option is getting the JFrog mirror/curation policies aligned so needed versions are available promptly.