Skip to content

Enforce a three-day dependency cooldown - #6426

Merged
jmecom merged 1 commit into
mainfrom
jm/dependency-cooldowns
Aug 20, 2026
Merged

Enforce a three-day dependency cooldown#6426
jmecom merged 1 commit into
mainfrom
jm/dependency-cooldowns

Conversation

@jmecom

@jmecom jmecom commented Aug 20, 2026

Copy link
Copy Markdown
Collaborator

Configure Renovate to wait three days before proposing newly released dependencies.

The policy requires a registry publication timestamp and suppresses branches until the release ages past the window. Renovate security-alert updates continue to bypass minimum-release-age checks, so known fixes are not delayed.

Checked with renovate-config-validator --strict --no-global renovate.json, jq, and git diff --check.

@jmecom
Enforce dependency release cooldowns
a2e58fb 
Signed-off-by: Jordan Mecom <jm@squareup.com>
@jmecom
jmecom marked this pull request as ready for review August 20, 2026 19:09
@jmecom
jmecom requested a review from a team as a code owner August 20, 2026 19:09
@jmecom
jmecom enabled auto-merge (squash) August 20, 2026 19:10
@jmecom
jmecom merged commit 3ee465e into main Aug 20, 2026
24 checks passed
@jmecom
jmecom deleted the jm/dependency-cooldowns branch August 20, 2026 19:26
atishpatel added a commit that referenced this pull request Aug 20, 2026
@atishpatel
Merge remote-tracking branch 'origin/main' into benchmark/harness-acc…
af1a30b 
…ounting-and-solo

* origin/main: (48 commits)
  fix(hooks): scope pre-push lanes to branch merge-base diff (#6423)
  Enforce a three-day dependency cooldown (#6426)
  perf(desktop): resolve references without directory scans (#6328)
  feat(llm): stamp thinking effort on call-completed log line (#6424)
  Fix cross-owner relay agent mentions in owner-only builds (#6338)
  feat(cli): accept Buzz message links for thread reads (#6359)
  feat(workflows): add workflow editor (#6248)
  fix(desktop): preserve huddle speech boundaries (#6397)
  test(desktop): use a wordlist-safe separator in passphrase word-count test (#6356)
  fix(models): curate Databricks alias-aware labels for 5 missing endpoints (#6360)
  fix(acp): guard against unrequested public relay skills (#6394)
  feat(desktop): refine context-aware Projects collaboration (#6396)
  fix(desktop): distinguish duplicate agent devices (#6337)
  feat(desktop): close Buzz window with Cmd+W (#6314)
  refactor(prompt): simplify Buzz agent guidance (#6340)
  feat(desktop): make Projects workspaces selectable (#6368)
  Add Buzz-native collaboration benchmarks (#6264)
  Polish mobile timeline and emoji interactions (#6297)
  feat(desktop): make the Projects overview follow the selected section (#6335)
  refactor(desktop): coordinate TTS playback (#6341)
  ...

Signed-off-by: Atish Patel <atishpatel2012@gmail.com>
brow added a commit that referenced this pull request Aug 20, 2026
@brow
Merge remote-tracking branch 'origin/main' into codex/mobile-push-not…
669d86c 
…ifications-pr

* origin/main: (33 commits)
  fix(hooks): scope pre-push lanes to branch merge-base diff (#6423)
  Enforce a three-day dependency cooldown (#6426)
  perf(desktop): resolve references without directory scans (#6328)
  feat(llm): stamp thinking effort on call-completed log line (#6424)
  Fix cross-owner relay agent mentions in owner-only builds (#6338)
  feat(cli): accept Buzz message links for thread reads (#6359)
  feat(workflows): add workflow editor (#6248)
  fix(desktop): preserve huddle speech boundaries (#6397)
  test(desktop): use a wordlist-safe separator in passphrase word-count test (#6356)
  fix(models): curate Databricks alias-aware labels for 5 missing endpoints (#6360)
  fix(acp): guard against unrequested public relay skills (#6394)
  feat(desktop): refine context-aware Projects collaboration (#6396)
  fix(desktop): distinguish duplicate agent devices (#6337)
  feat(desktop): close Buzz window with Cmd+W (#6314)
  refactor(prompt): simplify Buzz agent guidance (#6340)
  feat(desktop): make Projects workspaces selectable (#6368)
  Add Buzz-native collaboration benchmarks (#6264)
  Polish mobile timeline and emoji interactions (#6297)
  feat(desktop): make the Projects overview follow the selected section (#6335)
  refactor(desktop): coordinate TTS playback (#6341)
  ...

Signed-off-by: Tom Brow <tomb@block.xyz>
@adrienlacombe adrienlacombe mentioned this pull request Aug 21, 2026
Merged
TheSentinel454 added a commit that referenced this pull request Aug 21, 2026
@TheSentinel454
Merge remote-tracking branch 'origin/main' into fizz/db-session-timeouts
2c9275e 
* origin/main: (64 commits)
  chore(deps): pin earshot below 1.2.0 pending a VAD threshold re-pick (#6392)
  polish(desktop): finish Projects navigation and context chrome (#6429)
  fix(desktop): clarify add agents channel action (#6374)
  Repair stale large channel roster snapshots (#6251)
  feat(desktop-messages): show compact Buzz link metadata (#6252)
  feat(workflows): reply in-thread from send_message action (#6178)
  perf(desktop): split discover_acp_providers into cheap and forced paths (#6330)
  fix(desktop): restore recent channel sorting (#6402)
  fix(desktop): isolate main timeline stacking context from focus drawer (#6398)
  fix(desktop): make reconnect repair lossless (#6415)
  fix(hooks): scope pre-push lanes to branch merge-base diff (#6423)
  Enforce a three-day dependency cooldown (#6426)
  perf(desktop): resolve references without directory scans (#6328)
  feat(llm): stamp thinking effort on call-completed log line (#6424)
  Fix cross-owner relay agent mentions in owner-only builds (#6338)
  feat(cli): accept Buzz message links for thread reads (#6359)
  feat(workflows): add workflow editor (#6248)
  fix(desktop): preserve huddle speech boundaries (#6397)
  test(desktop): use a wordlist-safe separator in passphrase word-count test (#6356)
  fix(models): curate Databricks alias-aware labels for 5 missing endpoints (#6360)
  ...

Signed-off-by: Luke Tornquist <tornquist@squareup.com>
TheSentinel454 added a commit that referenced this pull request Aug 21, 2026
@TheSentinel454
Merge remote-tracking branch 'origin/main' into codex/agent-owned-wor…
e93c388 
…kflow-management

* origin/main: (27 commits)
  chore(deps): pin earshot below 1.2.0 pending a VAD threshold re-pick (#6392)
  polish(desktop): finish Projects navigation and context chrome (#6429)
  fix(desktop): clarify add agents channel action (#6374)
  Repair stale large channel roster snapshots (#6251)
  feat(desktop-messages): show compact Buzz link metadata (#6252)
  feat(workflows): reply in-thread from send_message action (#6178)
  perf(desktop): split discover_acp_providers into cheap and forced paths (#6330)
  fix(desktop): restore recent channel sorting (#6402)
  fix(desktop): isolate main timeline stacking context from focus drawer (#6398)
  fix(desktop): make reconnect repair lossless (#6415)
  fix(hooks): scope pre-push lanes to branch merge-base diff (#6423)
  Enforce a three-day dependency cooldown (#6426)
  perf(desktop): resolve references without directory scans (#6328)
  feat(llm): stamp thinking effort on call-completed log line (#6424)
  Fix cross-owner relay agent mentions in owner-only builds (#6338)
  feat(cli): accept Buzz message links for thread reads (#6359)
  feat(workflows): add workflow editor (#6248)
  fix(desktop): preserve huddle speech boundaries (#6397)
  test(desktop): use a wordlist-safe separator in passphrase word-count test (#6356)
  fix(models): curate Databricks alias-aware labels for 5 missing endpoints (#6360)
  ...

Signed-off-by: Luke Tornquist <tornquist@squareup.com>

# Conflicts:
#	desktop/src/features/workflows/ui/WorkflowDeleteDialog.tsx
#	desktop/src/features/workflows/ui/WorkflowsView.tsx
wpfleger96 pushed a commit that referenced this pull request Aug 21, 2026
Duncan
Merge remote-tracking branch 'origin/main' into wpfleger/archive-rete…
4106128 
…ntion-phase1

* origin/main: (37 commits)
  fix(desktop): sender names in notifications + macOS click-through routing (#6427)
  docs: clarify two-layer moderation ownership (#6481)
  Fix mobile thread tail and iOS channel header (#6399)
  chore(deps): pin earshot below 1.2.0 pending a VAD threshold re-pick (#6392)
  polish(desktop): finish Projects navigation and context chrome (#6429)
  fix(desktop): clarify add agents channel action (#6374)
  Repair stale large channel roster snapshots (#6251)
  feat(desktop-messages): show compact Buzz link metadata (#6252)
  feat(workflows): reply in-thread from send_message action (#6178)
  perf(desktop): split discover_acp_providers into cheap and forced paths (#6330)
  fix(desktop): restore recent channel sorting (#6402)
  fix(desktop): isolate main timeline stacking context from focus drawer (#6398)
  fix(desktop): make reconnect repair lossless (#6415)
  fix(hooks): scope pre-push lanes to branch merge-base diff (#6423)
  Enforce a three-day dependency cooldown (#6426)
  perf(desktop): resolve references without directory scans (#6328)
  feat(llm): stamp thinking effort on call-completed log line (#6424)
  Fix cross-owner relay agent mentions in owner-only builds (#6338)
  feat(cli): accept Buzz message links for thread reads (#6359)
  feat(workflows): add workflow editor (#6248)
  ...

Signed-off-by: Duncan <dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95@buzz.block.builderlab.xyz>
wpfleger96 pushed a commit that referenced this pull request Aug 21, 2026
Duncan
Merge remote-tracking branch 'origin/main' into wpfleger/deterministi…
17d50d7 
…c-agent-commit-identity

* origin/main: (40 commits)
  chore(release): release Buzz Desktop version 0.5.18 (#6489)
  fix(desktop): simplify duplicate agent provenance (#6401)
  test(benchmarks): expand Buzz-native dataset (#6448)
  fix(desktop): sender names in notifications + macOS click-through routing (#6427)
  docs: clarify two-layer moderation ownership (#6481)
  Fix mobile thread tail and iOS channel header (#6399)
  chore(deps): pin earshot below 1.2.0 pending a VAD threshold re-pick (#6392)
  polish(desktop): finish Projects navigation and context chrome (#6429)
  fix(desktop): clarify add agents channel action (#6374)
  Repair stale large channel roster snapshots (#6251)
  feat(desktop-messages): show compact Buzz link metadata (#6252)
  feat(workflows): reply in-thread from send_message action (#6178)
  perf(desktop): split discover_acp_providers into cheap and forced paths (#6330)
  fix(desktop): restore recent channel sorting (#6402)
  fix(desktop): isolate main timeline stacking context from focus drawer (#6398)
  fix(desktop): make reconnect repair lossless (#6415)
  fix(hooks): scope pre-push lanes to branch merge-base diff (#6423)
  Enforce a three-day dependency cooldown (#6426)
  perf(desktop): resolve references without directory scans (#6328)
  feat(llm): stamp thinking effort on call-completed log line (#6424)
  ...

Signed-off-by: Duncan <dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95@buzz.block.builderlab.xyz>
tellaho added a commit that referenced this pull request Aug 21, 2026
@tellaho Carl
Merge origin/main into tho/composer-auto-address
62bf285 
* origin/main: (28 commits)
  chore(release): release Buzz Desktop version 0.5.18 (#6489)
  fix(desktop): simplify duplicate agent provenance (#6401)
  test(benchmarks): expand Buzz-native dataset (#6448)
  fix(desktop): sender names in notifications + macOS click-through routing (#6427)
  docs: clarify two-layer moderation ownership (#6481)
  Fix mobile thread tail and iOS channel header (#6399)
  chore(deps): pin earshot below 1.2.0 pending a VAD threshold re-pick (#6392)
  polish(desktop): finish Projects navigation and context chrome (#6429)
  fix(desktop): clarify add agents channel action (#6374)
  Repair stale large channel roster snapshots (#6251)
  feat(desktop-messages): show compact Buzz link metadata (#6252)
  feat(workflows): reply in-thread from send_message action (#6178)
  perf(desktop): split discover_acp_providers into cheap and forced paths (#6330)
  fix(desktop): restore recent channel sorting (#6402)
  fix(desktop): isolate main timeline stacking context from focus drawer (#6398)
  fix(desktop): make reconnect repair lossless (#6415)
  fix(hooks): scope pre-push lanes to branch merge-base diff (#6423)
  Enforce a three-day dependency cooldown (#6426)
  perf(desktop): resolve references without directory scans (#6328)
  feat(llm): stamp thinking effort on call-completed log line (#6424)
  ...


# Conflicts:
#	desktop/src/features/channels/ui/ChannelPane.tsx
#	desktop/src/features/messages/ui/MentionAutocomplete.test.mjs
#	desktop/src/features/messages/ui/MentionAutocomplete.tsx

Co-authored-by: Carl <acda9e433d19dcd0e6b6840f7f4b98f3a56f1fab98049d444c087019e6d36560@buzz.block.builderlab.xyz>
Signed-off-by: Taylor Ho <taylorkmho@gmail.com>
@github-actions github-actions Bot mentioned this pull request Aug 22, 2026
Open
BradGroux pushed a commit to BradGroux/buzz that referenced this pull request Aug 23, 2026
@jmecom
Enforce a three-day dependency cooldown (block#6426)
48cbcea 
Configure Renovate to wait three days before proposing newly released
dependencies.

The policy requires a registry publication timestamp and suppresses
branches until the release ages past the window. Renovate security-alert
updates continue to bypass minimum-release-age checks, so known fixes
are not delayed.

Checked with `renovate-config-validator --strict --no-global
renovate.json`, `jq`, and `git diff --check`.

Signed-off-by: Jordan Mecom <jm@squareup.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@wesbillman wesbillman wesbillman approved these changes
@wpfleger96 wpfleger96 wpfleger96 approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@jmecom @wesbillman @wpfleger96