[rismehta]

Description

Exempt released @aemforms/af-core versions from Dependabot's cooldown so they can be considered on the next scheduled or manual update check.

• Branch from the latest fetched adobe/master, 16036c64c823be56676a6bfcfb15bf5771f106e4; refreshed again before publishing.
• Add cooldown.default-days: 3 with @aemforms/af-core in cooldown.exclude.
• Keep generated PRs targeted at dev, the npm /ui.frontend directory, exact dependency allowlist, daily schedule, one-open-PR limit, versioning strategy, labels, and commit prefix unchanged.
• Change only .github/dependabot.yml; no dependency versions, lockfiles, application code, or CI pipeline changes.

The exclusion remains configured for future af-core releases until explicitly removed. Other dependencies are not added to the allowlist and are not exempted from cooldown.

Related Issue

#2013

Follow-up to #2014 and #2015.

Motivation and Context

Dependabot run 41432228201 succeeded, reached the npm registry, and found the published 1.0.11 tarball, but filtered out that release because of cooldown:

Filtered out 1 versions due to cooldown
Latest version is 1.0.10
No update needed for @aemforms/af-core 1.0.10

GitHub applies a default three-day cooldown even when no cooldown is explicitly configured. This package-specific exclusion allows our released af-core dependency to be considered without that wait.

GitHub reads this configuration from default branch master. After this PR is merged, use Insights > Dependency graph > Dependabot > Check for updates to retry. Scheduled checks remain enabled; an actual update PR still depends on successful dependency resolution and the normal update rules.

How Has This Been Tested?

Passed: live SchemaStore validation and exact-scope checks using an isolated Python environment with PyYAML/jsonschema:

python3 - <<'PY'
import json
from pathlib import Path
import subprocess
import jsonschema
import yaml
config = yaml.safe_load(Path('.github/dependabot.yml').read_text())
with __import__('urllib.request', fromlist=['urlopen']).urlopen('https://json.schemastore.org/dependabot-2.0.json', timeout=30) as response:
    jsonschema.validate(config, json.load(response))
baseline = yaml.safe_load(subprocess.check_output(['git', 'show', 'HEAD:.github/dependabot.yml'], text=True))
assert len(config['updates']) == 1
update = config['updates'][0]
assert update['target-branch'] == 'dev'
assert update['allow'] == [{'dependency-name': '@aemforms/af-core'}]
assert update.pop('cooldown') == {'default-days': 3, 'exclude': ['@aemforms/af-core']}
assert config == baseline
assert subprocess.check_output(['git', 'diff', '--name-only'], text=True).splitlines() == ['.github/dependabot.yml']
print('PASS: live Dependabot schema; exact af-core-only cooldown exclusion; all previous configuration preserved; one-file scope')
PY

The command above was run before committing the change, so HEAD is the unchanged master baseline.

Passed: git diff --check.

Not run: Maven/unit/Cypress suites, because this changes only Dependabot policy and does not change application code or dependencies. No test cases were added. Live Dependabot acceptance requires this configuration to be merged into master; the previous run demonstrates the cooldown issue, not acceptance of this unmerged configuration.

Screenshots (if appropriate):

Not applicable; configuration only.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)

Checklist:

• I have signed the Adobe Open Source CLA.
• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I have read the CONTRIBUTING document.
• I have added tests to cover my changes and the overall coverage did not decrease.
• All unit tests pass on CircleCi.
• I ran all tests locally and they pass.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[adobe-bot]

Accessibility Violations Found

Id	Impact
aria-required-attr	critical
empty-heading	minor
label-title-only	serious
target-size	serious

[adobe-bot]

Accessibility Violations Found

Id	Impact
aria-required-attr	critical
empty-heading	minor
label-title-only	serious
target-size	serious