Basic concepts

What is Dependabot?

Dependabot automates dependencies management and supply chain security for free.

With a simple dependabot.yml file in your repository and a few lines inside, you can automatically raise pull requests to keep your dependencies up-to-date.

This is major in terms of security, as supply chain attacks are rising these days.

Is it only for GitHub?

Yes. Microsoft (GitHub) acquired the company some time ago.

What is GitHub Advisory Database?

It's the main database that Dependabot uses to learn about security vulnerabilities.

How can I enable Dependabot?

Go to YOUR_REPO/settings/security_analysis. You get a dedicated page "Code security and analysis" where you can enable Dependabot's features.

Where do I put the configuration file?

On GitHub, you can create the file here: /.github/dependabot.yml.

Getting started with dependabot.yml

Here is a very basic example to handle npm dependencies:

version: 2
updates:
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "weekly"

Don't forget the version parameter!

Is it for public packages only?

No. You can add a registries section containing authentication details to the dependabot.yml file:

version: 2
registries:
    npm-npmjs:
        type: npm-registry
        url: https://registry.npmjs.org
        username: my_username
        password: ${{secrets.MY_NPM_PASSWORD}}
updates:
  - package-ecosystem: "npm" # could be "bundler", pip", "docker", "composer", etc @see https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#package-ecosystem
    directory: "/"
    schedule:
      interval: "weekly"

Schedule interval

The schedule interval is a required setting and probably one of the most critical ones as it determines the cycle of updates and PRs.

I really appreciate the possibility to delay updates because you don't have infinite time to allocate to each repository. There are different options:

• daily
• weekly
• monthly

You can add schedule.day if you choose weekly to start the cycle on some day other than Monday:

    schedule:
      interval: "weekly"
      day: "friday"

You can even add a specific time:

    schedule:
      interval: "weekly"
      day: "friday"
      time: "10:01" #10:01am UTC

If you don't want to use UTC, you can specify a timezone:

    schedule:
      interval: "weekly"
      day: "friday"
      time: "10:01"
      timezone: "Europe/Vatican"

Custom labels

The default label for all PRs is "dependencies" by default, but you might want to customize that, especially when you handle multiple packages ecosystems:

updates:
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "weekly"
    labels: "npm-dependencies"
  - package-ecosystem: "docker"
    directory: "/"
    schedule:
      interval: "weekly"
    labels:
      - "docker-dependencies"

It's also great to keep things organized. Note that you can use several labels for each package ecosystem.

Target branches

You can use the target-branch parameter to prevent Dependabot from raising PRs only on the default branch. Note that you can add a custom branch per each package ecosystem:

updates:
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "weekly"
    labels: "npm-dependencies"
    target-branch: "trunk"

Available packages ecosystems

Go there

Helpful commands

You can "talk" with the bot by commenting the PR with special commands, which can save a lot of time. For example, I often use the @dependabot rebase command to resolve merge conflicts between several PRs that update the same dependencies.

It's quite often enough to proceed!

Things to know and errors to avoid

Dependabot is fantastic but be aware of potential mistakes:

• Don't merge PRs blindly, as you might break your app
• Add a CI server whenever you can, especially for live production apps
• Dependabot does not automatically warn of absolutely everything, keep some monitoring
• Enabling Dependabot grants read-only permission to GitHub for analysis purpose
• Dependabot may have some issues when trying to read your dependency file, so check it carefully
• PRs' reviews should be done by several members of the team, not just one person
• Remove unused dependencies

More advanced usages

Dependabot is pretty straightforward but you might need more advanced usages.

open-pull-requests-limit

By default, Dependabot cannot open more than 5 PRs at the same time, but you can change this setting per each package ecosystem:

version: 2
updates:
  - package-ecosystem: "composer"
    directory: "/"
    schedule:
      interval: "weekly"
    open-pull-requests-limit: 12

How to disable PRs for a specific package ecosystem

You may set the open pull requests limit to 0:

updates:
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "weekly"
    labels: "npm-dependencies"
    open-pull-requests-limit: 0 # 0 will disable PRs
  - package-ecosystem: "docker"
    directory: "/"
    schedule:
      interval: "weekly"
    labels:
      - "docker-dependencies"
    open-pull-requests-limit: 12

Auto merges

It's possible to connect Dependabot to scheduled actions for automatic merges. While it's not something I would recommend, you might beg to differ. Here's a nice introduction.

versioning-strategy

The versioning-strategy parameter can be helpful to change the default strategy according to the package manager.

For example, you might want to increase the version with Composer dependencies only when it's required. In such case, you can do:

version: 2
updates:
  - package-ecosystem: "composer"
    directory: "/"
    schedule:
      interval: "weekly"
    versioning-strategy: increase-if-necessary

Dependency Graph

Go to YOUR_REPO/network/dependencies to get an overview of all your dependencies. There's even a tab called "Dependents" where you can list repositories that depend on your repository.