Skip to content

chore: re-enable dependabot with 2-day cooldown#8377

Merged
andrewlock merged 1 commit into
masterfrom
re-enable-dependabot-cooldown
Mar 27, 2026
Merged

chore: re-enable dependabot with 2-day cooldown#8377
andrewlock merged 1 commit into
masterfrom
re-enable-dependabot-cooldown

Conversation

@moezein0

@moezein0 moezein0 commented Mar 26, 2026

Copy link
Copy Markdown
Contributor

Note

Merge only if this is still needed and your repo is not managed by ADMS.
If your repository is already managed by ADMS, feel free to close or ignore this PR.

We are adding a 2-day cooldown on dependencies to reduce the risk of zero-day vulnerabilities.

This PR re-enables your Dependabot configuration and introduces the cooldown setting. If you notice any other Dependabot configurations in your repo that are missing the cooldown, please ensure it is added.

If your repository is already managed by ADMS and no longer requires these configurations, feel free to close or ignore the PR.

@moezein0
re-enable dependabot with 2-day cooldown
be0d2dc 
Rename .disabled configs back and add cooldown: default-days: 2

Signed-off-by: Moe Zein <[email protected]>
@moezein0
moezein0 requested a review from a team as a code owner March 26, 2026 16:13
@moezein0
moezein0 force-pushed the re-enable-dependabot-cooldown branch from 6194e59 to be0d2dc Compare March 26, 2026 16:13
@github-actions github-actions Bot added the area:builds project files, build scripts, pipelines, versioning, releases, packages label Mar 26, 2026
@pr-commenter

pr-commenter Bot commented Mar 26, 2026

Copy link
Copy Markdown

Benchmarks

Benchmark execution time: 2026-03-26 16:56:18

Comparing candidate commit be0d2dc in PR branch re-enable-dependabot-cooldown with baseline commit 6087ef6 in branch master.

Found 4 performance improvements and 1 performance regressions! Performance is the same for 267 metrics, 16 unstable metrics.

Explanation

This is an A/B test comparing a candidate commit's performance against that of a baseline commit. Performance changes are noted in the tables below as:

  • 🟩 = significantly better candidate vs. baseline
  • 🟥 = significantly worse candidate vs. baseline

We compute a confidence interval (CI) over the relative difference of means between metrics from the candidate and baseline commits, considering the baseline as the reference.

If the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD), the change is considered significant.

Feel free to reach out to #apm-benchmarking-platform on Slack if you have any questions.

More details about the CI and significant changes

You can imagine this CI as a range of values that is likely to contain the true difference of means between the candidate and baseline commits.

CIs of the difference of means are often centered around 0%, because often changes are not that big:

---------------------------------(------|---^--------)-------------------------------->
                              -0.6%    0%  0.3%     +1.2%
                                 |          |        |
         lower bound of the CI --'          |        |
sample mean (center of the CI) -------------'        |
         upper bound of the CI ----------------------'

As described above, a change is considered significant if the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD).

For instance, for an execution time metric, this confidence interval indicates a significantly worse performance:

----------------------------------------|---------|---(---------^---------)---------->
                                       0%        1%  1.3%      2.2%      3.1%
                                                  |   |         |         |
       significant impact threshold --------------'   |         |         |
                      lower bound of CI --------------'         |         |
       sample mean (center of the CI) --------------------------'         |
                      upper bound of CI ----------------------------------'

scenario:Benchmarks.Trace.CharSliceBenchmark.OptimizedCharSlice net6.0

  • 🟩 execution_time [-241.660µs; -235.273µs] or [-14.739%; -14.350%]
  • 🟩 throughput [+102.474op/s; +105.140op/s] or [+16.801%; +17.238%]

scenario:Benchmarks.Trace.DbCommandBenchmark.ExecuteNonQuery netcoreapp3.1

  • 🟩 throughput [+18544.892op/s; +26339.559op/s] or [+5.086%; +7.224%]

scenario:Benchmarks.Trace.Iast.StringAspectsBenchmark.StringConcatAspectBenchmark netcoreapp3.1

  • 🟩 allocated_mem [-20.730KB; -20.691KB] or [-7.516%; -7.502%]

scenario:Benchmarks.Trace.SpanBenchmark.StartFinishSpan net6.0

  • 🟥 execution_time [+14.105ms; +14.445ms] or [+7.050%; +7.220%]

@andrewlock
andrewlock merged commit 05f70bb into master Mar 27, 2026
99 of 102 checks passed
@andrewlock
andrewlock deleted the re-enable-dependabot-cooldown branch March 27, 2026 08:03
@github-actions github-actions Bot added this to the vNext-v3 milestone Mar 27, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@bouwkast bouwkast bouwkast approved these changes
@andrewlock andrewlock andrewlock approved these changes

Assignees

No one assigned

Labels

area:builds project files, build scripts, pipelines, versioning, releases, packages

Projects

None yet

Milestone

3.41.0

Development

Successfully merging this pull request may close these issues.

3 participants

@moezein0 @bouwkast @andrewlock