What is the GitHub 'Dependabot version updates' configuration file and where is it placed?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Dependabot version updates are driven by a YAML config file at .github/dependabot.yml. You define which package ecosystems to monitor, how often to check, and grouping preferences. No config file = no version update PRs.
Full explanation below image
Full Explanation
Dependabot version updates (keeping dependencies up to date with latest versions, not just security patches) are configured through a YAML file placed at .github/dependabot.yml in the repository. The configuration defines: (1) Which package ecosystems to monitor (npm, pip, maven, docker, github-actions, etc.). (2) The directory where manifest files are located. (3) How frequently to check for updates (daily, weekly, monthly). (4) Grouping rules for batching multiple updates into single PRs. (5) Reviewer and assignee configuration for generated PRs. (6) Target branch for update PRs. (7) Ignore rules for specific packages or version ranges. Without a dependabot.yml file, Dependabot security updates can still run (if enabled in org settings), but version updates require the explicit configuration file.