dependabot
Comprehensive guide for configuring and managing GitHub Dependabot. Use this skill when users ask about creating or optimizing dependabot.yml files, managing Dependabot pull requests, configuring dependency update strategies, setting up grouped updates, monorepo patterns, multi-ecosystem groups, security update configuration, auto-triage rules, or any GitHub Advanced Security (GHAS) supply chain security topic related to Dependabot. For pre-commit dependency vulnerability scanning in AI coding agents via the GitHub MCP Server, this skill references the Advanced Security plugin (`advanced-secur
Profile →npx skills add github/awesome-copilot --skill dependabot --agent copilot
Same command for any agent — swap --agent for claude-code, codex, cursor.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Dependabot Configuration & Management ## Overview Dependabot is GitHub's built-in dependency management tool with three core capabilities: 1. **Dependabot Alerts** — Notify when dependencies have known vulnerabilities (CVEs) 2. **Dependabot Security Updates** — Auto-create PRs to fix vulnerable dependencies 3. **Dependabot Version Updates** — Auto-create PRs to keep dependencies current All configuration lives in a **single file**: `.github/dependabot.yml` on the default branch. GitHub does **not** support multiple `dependabot.yml` files per repository. ## Configuration Workflow Follow this process when creating or optimizing a `dependabot.yml`: ### Step 1: Detect All Ecosystems Scan the repository for dependency manifests. Look for: | Ecosystem | YAML Value | Manifest Files | |---|---|---| | npm/pnpm/yarn | `npm` | `package.json`, `package-lock.json`, `pnpm-lock.yaml`, `yarn.lock` | | pip/pipenv/poetry | `pip` | `requirements.txt`, `Pipfile`, `pyproject.toml`, `setup.py` | | uv | `uv` | `pyproject.toml`, `uv.lock` | | Docker | `docker` | `Dockerfile` | | Docker Compose | `docker-compose` | `docker-compose.yml` | | GitHub Actions | `github-actions` | `.github/workflows/*.yml` | |
- Overview
- Configuration Workflow
- Step 1: Detect All Ecosystems
- Step 2: Map Directory Locations
- Step 3: Configure Each Ecosystem Entry
- Step 4: Optimize with Grouping, Labels, and Scheduling
- Monorepo Strategies
- Glob Patterns for Workspace Coverage
- Cross-Directory Grouping
- Standalone Packages Outside Workspaces
- Dependency Grouping
- By Dependency Type
- By Name Pattern
- For Security Updates
Enable the dependabot toolset for the GitHub MCP Server copilot --add-github-mcp-toolset dependabot
What does the dependabot skill do?
Comprehensive guide for configuring and managing GitHub Dependabot. Use this skill when users ask about creating or optimizing dependabot.yml files, managing Dependabot pull requests, configuring dependency update strategies, setting up grouped updates, monorepo patterns, multi-ecosystem groups, security update configuration, auto-triage rules, or any GitHub Advanced Security (GHAS) supply chain security topic related to Dependabot. For pre-commit dependency vulnerability scanning in AI coding agents via the GitHub MCP Server, this skill references the Advanced Security plugin (`advanced-secur
How do I install it?
Run `npx skills add github/awesome-copilot --skill dependabot --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From github/awesome-copilot, a repository with 37,432 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.