We should mitigate the risk of malicious code in our frontend dependencies. Supply chain attacks are becoming more common so we should make it less likely that we will be affected by them.
Disabling scripts and setting min dependency version age are two straight forward changes that we can make.
The current Dependabot config does not specify the cooldown option. Dependabot by default has no cooldown at all (see docs), setting this to the same value as e.g. npmMinimalAgeGate from the supply chain risk PR is needed.