From 7b6ceadad63fcd881f2cf9ee9e821d8de634e24b Mon Sep 17 00:00:00 2001
From: "Jens H. Nielsen" <jenielse@microsoft.com>
Date: Wed, 19 Aug 2026 09:53:50 +0200
Subject: [PATCH 1/2] Configure dependabot with 7 days cooldown

---
 .github/dependabot.yml | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index eb97e4e89200..10b8e4ace68c 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -4,6 +4,8 @@ updates:
   directory: "/"
   schedule:
     interval: daily
+  cooldown:
+    default-days: 7
   open-pull-requests-limit: 20
   rebase-strategy: "disabled"
   versioning-strategy: increase-if-necessary
@@ -27,17 +29,17 @@ updates:
   schedule:
     interval: "daily"
 
-- package-ecosystem: pip
-  directory: /.binder
-  schedule:
-    interval: daily
-
 - package-ecosystem: npm
   directory: /.github
   schedule:
     interval: daily
+  cooldown:
+    default-days: 7
+
 
 - package-ecosystem: "pre-commit"
   directory: "/"
   schedule:
     interval: daily
+  cooldown:
+    default-days: 7

From e42027fd55d462cc6a3294814998faadc42f9e73 Mon Sep 17 00:00:00 2001
From: "Jens H. Nielsen" <jenielse@microsoft.com>
Date: Wed, 19 Aug 2026 10:15:32 +0200
Subject: [PATCH 2/2] Add package-lock.json

Dependabot no longer seems to want to update package.json if the lock file is missing
---
 .github/package-lock.json | 43 +++++++++++++++++++++++++++++++++++++++
 .gitignore                |  1 +
 2 files changed, 44 insertions(+)
 create mode 100644 .github/package-lock.json

diff --git a/.github/package-lock.json b/.github/package-lock.json
new file mode 100644
index 000000000000..bf3323799548
--- /dev/null
+++ b/.github/package-lock.json
@@ -0,0 +1,43 @@
+{
+  "name": ".github",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "devDependencies": {
+        "pyright": "1.1.409"
+      }
+    },
+    "node_modules/fsevents": {
+      "version": "2.3.3",
+      "resolved": "https://pkgs.dev.azure.com/ms-quantum/_packaging/gemini/npm/registry/fsevents/-/fsevents-2.3.3.tgz",
+      "integrity": "sha1-ysZAd4XQNnWipeGlMFxpezR9kNY=",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^8.16.0 || ^10.6.0 || >=11.0.0"
+      }
+    },
+    "node_modules/pyright": {
+      "version": "1.1.409",
+      "resolved": "https://pkgs.dev.azure.com/ms-quantum/_packaging/gemini/npm/registry/pyright/-/pyright-1.1.409.tgz",
+      "integrity": "sha1-zZaB8hMtX2DKBobnqloTRmkMow4=",
+      "dev": true,
+      "license": "MIT",
+      "bin": {
+        "pyright": "index.js",
+        "pyright-langserver": "langserver.index.js"
+      },
+      "engines": {
+        "node": ">=14.0.0"
+      },
+      "optionalDependencies": {
+        "fsevents": "~2.3.3"
+      }
+    }
+  }
+}
diff --git a/.gitignore b/.gitignore
index ba828b54b429..34ff9fa62529 100644
--- a/.gitignore
+++ b/.gitignore
@@ -119,6 +119,7 @@ docs/examples/driver_examples/instrument_group_example.yaml
 
 # Do not ignore pyright npm version file
 !.github/package.json
+!.github/package-lock.json
 
 # we are not currently checking in uv.lock
 uv.lock