add dependency cooldown - to avoid many supply chain issues

Author: Hamish Downer

.github/dependabot.yml

@@ -2,6 +2,9 @@ version: 2
 
 updates:
   - package-ecosystem: "uv"
+    cooldown:
+      default-days: 7
+      semver-major-days: 14
     directory: "/"
     schedule:
       interval: "weekly"
@@ -10,6 +13,7 @@ updates:
   - package-ecosystem: "github-actions"
     # Workflow files stored in the default location of `.github/workflows`
     # You don't need to specify `/.github/workflows` for `directory`. You can use `directory: "/"`.
+    # cooldown is not supported
     directory: "/"
     schedule:
       interval: "weekly"

pyproject.toml

@@ -67,6 +67,9 @@ build-backend = "hatchling.build"
 [tool.hatch.build.targets.wheel]
 packages = ["src/sortition_algorithms"]
 
+[tool.uv]
+exclude-newer = "1 week"
+
 [tool.mypy]
 files = ["src"]
 disallow_untyped_defs = true