Hi, It seems that `dependabot` is skipping the `cooldown` config to update that action. Is it a security update? If yes: - Why? #2530? - Is there a flag indicated it's a security update? If no, why `dependabot` is updating it with a `cooldown` of 7 days. Thx