Build: Enable Dependabot Alerts + Security Updates

0/4 steps

✓📚 Read

✓👁 See

✓🎞 Animate

✓🎯 Test

5⚙️ Build

Build Steps

Progress

0/4

◆ Before you start

Prerequisites

GitHub repositoryRequired
Dependabot requires GitHub
Snyk account (optional)Optional
Free tier for reachability analysis
Get it ↗
npm or dotnet projectRequired
Existing project with dependencies

🤖

Step 1 of 4

Enable Dependabot Alerts + Security Updates

Activate Dependabot vulnerability alerts and automatic security update PRs for all dependency manifests in the repository.

Tasks

Create `.github/dependabot.yml` with the provided configuration

Push to main; Dependabot will begin scanning within a few minutes

Check repository Security → Dependabot alerts tab

🎯 What You'll Learn

▸Configure Dependabot for npm and/or dotnet
▸Set update schedules and PR limits
▸Understand the difference between version updates and security updates

Code

YAML.github/dependabot.yml
1 version: 2
2 updates:
3   # npm packages
4   - package-ecosystem: "npm"
5     directory: "/"
6     schedule:
7       interval: "weekly"
8       day: "monday"
9       time: "06:00"
10     open-pull-requests-limit: 10
11     groups:
12       production-dependencies:
13         dependency-type: "production"
14         update-types: ["patch", "minor"]
15     ignore:
16       - dependency-name: "typescript"
17         update-types: ["version-update:semver-major"]
18  
19   # GitHub Actions
20   - package-ecosystem: "github-actions"
21     directory: "/.github/workflows"
22     schedule:
23       interval: "weekly"
24

💡 Pro Tips

▸Enable `groups` to batch related updates into one PR — reduces review noise
▸Set `open-pull-requests-limit: 10` to avoid PR floods during initial setup

Expected Output

Dependabot alerts visible in Security tab; auto-PRs created for outdated packages

Discussion

1 version: 2 2 updates: 3 # npm packages 4 - package-ecosystem: "npm" 5 directory: "/" 6 schedule: 7 interval: "weekly" 8 day: "monday" 9 time: "06:00" 10 open-pull-requests-limit: 10 11 groups: 12 production-dependencies: 13 dependency-type: "production" 14 update-types: ["patch", "minor"] 15 ignore: 16 - dependency-name: "typescript" 17 update-types: ["version-update:semver-major"] 18 19 # GitHub Actions 20 - package-ecosystem: "github-actions" 21 directory: "/.github/workflows" 22 schedule: 23 interval: "weekly" 24

1	version: 2
2	updates:
3	# npm packages
4	- package-ecosystem: "npm"
5	directory: "/"
6	schedule:
7	interval: "weekly"
8	day: "monday"
9	time: "06:00"
10	open-pull-requests-limit: 10
11	groups:
12	production-dependencies:
13	dependency-type: "production"
14	update-types: ["patch", "minor"]
15	ignore:
16	- dependency-name: "typescript"
17	update-types: ["version-update:semver-major"]
18
19	# GitHub Actions
20	- package-ecosystem: "github-actions"
21	directory: "/.github/workflows"
22	schedule:
23	interval: "weekly"
24