You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
**Dependabot** is GitHub's automated dependency update tool. It scans your repository for outdated dependencies and opens pull requests to update them. It supports many ecosystems (npm, pip, Maven, Gradle, Docker, GitHub Actions, etc.) and is configured via a `dependabot.yml` file placed in the `.github` directory.
51
+
52
+
## 📁 File Location
53
+
54
+
Create the file at:
55
+
```
56
+
.github/dependabot.yml
57
+
```
58
+
59
+
## ⚙️ Basic Configuration
60
+
61
+
Here is a minimal configuration for a Node.js project with dependencies checked weekly:
62
+
63
+
```yaml
64
+
version: 2
65
+
updates:
66
+
- package-ecosystem: "npm" # see below for ecosystem list
67
+
directory: "/" # location of package.json
68
+
schedule:
69
+
interval: "weekly" # daily, weekly, monthly
70
+
```
71
+
72
+
## 📋 Common Package Ecosystems
73
+
74
+
| Ecosystem | `package-ecosystem` value | Example files |
open-pull-requests-limit: 10 # max open PRs at any time
101
+
labels:
102
+
- "dependencies"
103
+
- "npm"
104
+
reviewers:
105
+
- "username" # GitHub username
106
+
- "my-team" # team name
107
+
assignees:
108
+
- "username"
109
+
milestone: 5 # milestone number
110
+
versioning-strategy: increase # or lockfile-only (for npm)
111
+
allow:
112
+
- dependency-type: "direct" # only direct dependencies
113
+
ignore:
114
+
- dependency-name: "express"
115
+
versions: ["4.x", "5.x"] # ignore specific versions
116
+
commit-message:
117
+
prefix: "chore(deps)"
118
+
prefix-development: "chore(deps-dev)"
119
+
target-branch: "develop" # target branch for PRs
120
+
```
121
+
122
+
## 🧩 Example for a Multi‑Ecosystem Project
123
+
124
+
Suppose your project has a Node.js frontend, a Python backend, and uses Docker and GitHub Actions. You can configure multiple update blocks:
125
+
126
+
```yaml
127
+
version: 2
128
+
updates:
129
+
- package-ecosystem: "npm"
130
+
directory: "/frontend"
131
+
schedule:
132
+
interval: "weekly"
133
+
134
+
- package-ecosystem: "pip"
135
+
directory: "/backend"
136
+
schedule:
137
+
interval: "weekly"
138
+
139
+
- package-ecosystem: "docker"
140
+
directory: "/"
141
+
schedule:
142
+
interval: "monthly"
143
+
144
+
- package-ecosystem: "github-actions"
145
+
directory: "/"
146
+
schedule:
147
+
interval: "weekly"
148
+
```
149
+
150
+
## 🔒 Security Updates vs Version Updates
151
+
152
+
- **Version updates**: Dependabot checks for newer versions and opens PRs based on your schedule. This must be enabled in the repository settings.
153
+
- **Security updates**: GitHub automatically opens PRs for vulnerable dependencies regardless of schedule. They appear as "security" PRs.
154
+
155
+
To enable version updates, you must have `dependabot.yml` and ensure the feature is enabled in the repository (Settings → Code security and analysis → Dependabot version updates).
156
+
157
+
## 🚀 Enabling Dependabot on GitHub
158
+
159
+
1. Go to your repository on GitHub.
160
+
2. Click **Settings** → **Code security and analysis**.
161
+
3. Under **Dependabot**, enable **Dependabot alerts** and **Dependabot security updates**.
162
+
4. For version updates, you need the `dependabot.yml` file; GitHub will automatically pick it up.
163
+
164
+
## 💡 Tips & Best Practices
165
+
166
+
- **Start with `open-pull-requests-limit`** to avoid flooding your PR list.
167
+
- **Use `labels` and `reviewers`** to automate assignment.
168
+
- For monorepos, set multiple update blocks pointing to different subdirectories.
169
+
- **Combine with GitHub Actions** – Dependabot PRs can trigger your CI workflows to test the updates.
170
+
- **Ignore major updates** if you're not ready, using the `ignore` option.
For a full reference, see [GitHub Dependabot documentation](https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file).
176
+
177
+
---
178
+
179
+
Would you like me to create a `dependabot.yml` tailored specifically to your project stack (Node.js, Python, Docker, GitHub Actions)? Just tell me the folders and ecosystems!
0 commit comments