Comprehensive guide for configuring and managing GitHub Dependabot. Use this skill when users ask about creating or optimizing dependabot.yml files, managing Dependabot pull requests, configuring dependency update strategies, setting up grouped updates, monorepo patterns, multi-ecosystem groups, security update configuration, auto-triage rules, or any GitHub Advanced Security (GHAS) supply chain security topic related to Dependabot.
Comprehensive guide for configuring and managing GitHub Dependabot. Use this skill when users ask about creating or optimizing dependabot.yml files, managing Dependabot pull requests, configuring dependency update strategies, setting up grouped updates, monorepo patterns, multi-ecosystem groups, security update configuration, auto-triage rules, or any GitHub Advanced Security (GHAS) supply chain security topic related to Dependabot.
Dependabot Configuration & Management
Overview
Dependabot is GitHub's built-in dependency management tool with three core capabilities:
Dependabot Alerts — Notify when dependencies have known vulnerabilities (CVEs)
Dependabot Security Updates — Auto-create PRs to fix vulnerable dependencies
Dependabot Version Updates — Auto-create PRs to keep dependencies current
All configuration lives in a single file: .github/dependabot.yml on the default branch. GitHub does not support multiple dependabot.yml files per repository.
Configuration Workflow
Follow this process when creating or optimizing a dependabot.yml:
Step 1: Detect All Ecosystems
Scan the repository for dependency manifests. Look for:
open-pull-requests-limit:0# disables version update PRs
Auto-Triage Rules
GitHub presets auto-dismiss low-impact alerts for development dependencies. Custom rules can filter by severity, package name, CWE, and more. Configure in repository Settings → Advanced Security.
PR Comment Commands
Interact with Dependabot PRs using @dependabot comments.
Note: As of January 2026, merge/close/reopen commands have been deprecated.
Use GitHub's native UI, CLI (gh pr merge), or auto-merge instead.
Command
Effect
@dependabot rebase
Rebase the PR
@dependabot recreate
Recreate the PR from scratch
@dependabot ignore this dependency
Close and never update this dependency
@dependabot ignore this major version
Ignore this major version
@dependabot ignore this minor version
Ignore this minor version
@dependabot ignore this patch version
Ignore this patch version
For grouped PRs, additional commands:
@dependabot ignore DEPENDENCY_NAME — ignore specific dependency in group
@dependabot unignore DEPENDENCY_NAME — clear ignores, reopen with updates
@dependabot unignore * — clear all ignores for all dependencies in group
@dependabot show DEPENDENCY_NAME ignore conditions — display current ignores
For the complete command reference, see references/pr-commands.md.
Can I have multiple dependabot.yml files?
No. GitHub supports exactly one file at .github/dependabot.yml. Use multiple updates entries within that file for different ecosystems and directories.
Does Dependabot support pnpm?
Yes. Use package-ecosystem: "npm" — Dependabot detects pnpm-lock.yaml automatically.
How do I reduce PR noise in a monorepo?
Use groups to batch updates, directories with globs for coverage, and group-by: dependency-name for cross-directory grouping. Consider monthly or quarterly intervals for low-priority ecosystems.
How do I handle dependencies outside the workspace?
Create a separate ecosystem entry with its own directory pointing to that location.
