Dependabot

Dependabot automatically opens PRs to update dependencies and fix known vulnerabilities.

Dependabot keeps your dependencies healthy in two ways:

  • Security updates — alerts and PRs when a dependency has a known vulnerability.
  • Version updates — scheduled PRs to bump dependencies to newer versions.

Enabling it

Turn on alerts in Settings → Security, and add a .github/dependabot.yml file to schedule version updates for each package ecosystem.

Example

Example · yaml
# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: npm
    directory: "/"
    schedule:
      interval: weekly
  - package-ecosystem: github-actions
    directory: "/"
    schedule:
      interval: monthly

When to use it

  • A team enables Dependabot version updates to receive weekly PRs updating npm dependencies, keeping the project current without manual tracking.
  • Dependabot detects a critical CVE in a transitive dependency and opens a security-update PR within hours of the advisory being published.
  • A monorepo team configures separate Dependabot schedules for each app directory so update PRs are grouped by service, not mixed together.

More examples

Enable Dependabot for npm and Actions

Configures weekly npm updates (capped at 5 open PRs) and monthly GitHub Actions version updates in a single file.

Example · yaml
# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: npm
    directory: /
    schedule:
      interval: weekly
    open-pull-requests-limit: 5

  - package-ecosystem: github-actions
    directory: /
    schedule:
      interval: monthly

Group minor updates into one PR

The groups key merges all minor and patch bumps into a single PR instead of creating one PR per package, reducing noise.

Example · yaml
# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: npm
    directory: /
    schedule:
      interval: weekly
    groups:
      minor-and-patch:
        update-types:
          - minor
          - patch

Auto-merge Dependabot patch PRs

A workflow that detects Dependabot as the PR author and enables auto-merge, so patch updates land automatically after CI passes.

Example · yaml
name: Auto-merge Dependabot
on: pull_request
jobs:
  auto-merge:
    if: github.actor == 'dependabot[bot]'
    runs-on: ubuntu-latest
    permissions:
      pull-requests: write
      contents: write
    steps:
      - uses: actions/checkout@v4
      - run: gh pr merge --auto --squash "$PR_URL"
        env:
          PR_URL: ${{ github.event.pull_request.html_url }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Related

gh secrets scanninggh ci example

Discussion

  • Be the first to comment on this lesson.
Dependabot — GitHub | SoundsCode