Dependabot: dependabot.yml Configuration Reference

By Daniel Zoghalchali·Latchkey

Dependabot is configured by a YAML file, not a workflow, and opens dependency-update PRs for you.

Place .github/dependabot.yml to tell Dependabot which package ecosystems to watch, how often, and how to group updates. It also keeps your GitHub Actions versions current.

Key fields

• package-ecosystem: npm, pip, docker, github-actions, and more.
• directory: where the manifest lives.
• schedule.interval: daily, weekly, or monthly.
• groups: bundle related updates into one PR.
• ignore: skip specific dependencies or versions.
• open-pull-requests-limit: cap concurrent update PRs.

Example config

version: 2
updates:
  - package-ecosystem: npm
    directory: /
    schedule:
      interval: weekly
    groups:
      minor-and-patch:
        update-types: [minor, patch]
  - package-ecosystem: github-actions
    directory: /
    schedule:
      interval: weekly

Keep actions pinned and fresh

The github-actions ecosystem updates the action versions in your workflows, which pairs well with pinning actions to SHAs.

Pinning and supply-chain hygiene

A third-party action runs arbitrary code with access to your workflow token. Version tags are mutable, so @v4 can change under you without any commit in your repository.

# mutable: the tag can be repointed at any time
- uses: some/action@v4

# immutable: pin to the commit SHA, with the version in a comment
- uses: some/action@e2b3f4a5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1  # v4.1.2

Key takeaways

• dependabot.yml is config, not a workflow file.
• Add the github-actions ecosystem to update action versions.
• Use groups to cut PR noise from many small bumps.

Frequently asked questions

Related guides

References

• GitHub Actions documentation