skilld
All skills
github avatar

/dependabot

@b87ca29 official
by githubgithub/awesome-copilot40k stars
5,040

Comprehensive guide for configuring and managing GitHub Dependabot. Use this skill when users ask about creating or optimizing dependabot.yml files, managing Dependabot pull requests, configuring dependency update strategies, setting up grouped updates, monorepo patterns, multi-ecosystem groups, security update configuration, auto-triage rules, or any GitHub Advanced Security (GHAS) supply chain security topic related to Dependabot. For pre-commit dependency vulnerability scanning in AI coding agents via the GitHub MCP Server, this skill references the Advanced Security plugin (`advanced-security@copilot-plugins`). Use this skill when an agent needs to scan dependencies for known vulnerabilities before committing.

Ask your Agent

Use this Skill: https://skilld.dev/gh/github/awesome-copilot/dependabot

This session only. Nothing lands on disk.

referencespr-commands.md

≈1.1k tokens on demand. Your agent reads this file only when SKILL.md points to it.

Dependabot PR Comment Commands

Interact with Dependabot pull requests by commenting @dependabot <command>. Dependabot acknowledges commands with a thumbs-up reaction.

Deprecation Notice (January 27, 2026): The following commands have been removed: @dependabot merge, @dependabot squash and merge, @dependabot cancel merge, @dependabot close, and @dependabot reopen. Use GitHub's native UI, CLI (gh pr merge), API, or auto-merge feature instead.

Commands for Individual PRs

Command Description
@dependabot rebase Rebase the PR against the target branch
@dependabot recreate Recreate the PR from scratch, overwriting any manual edits
@dependabot ignore this dependency Close the PR and stop all future updates for this dependency
@dependabot ignore this major version Close and stop updates for this major version
@dependabot ignore this minor version Close and stop updates for this minor version
@dependabot ignore this patch version Close and stop updates for this patch version
@dependabot show DEPENDENCY_NAME ignore conditions Display a table of all current ignore conditions for the dependency

Commands for Grouped Updates

These commands work on Dependabot PRs created by grouped version or security updates.

Command Description
@dependabot ignore DEPENDENCY_NAME Close the PR and stop updating this dependency in the group
@dependabot ignore DEPENDENCY_NAME major version Stop updating this dependency's major version
@dependabot ignore DEPENDENCY_NAME minor version Stop updating this dependency's minor version
@dependabot ignore DEPENDENCY_NAME patch version Stop updating this dependency's patch version
@dependabot unignore * Close current PR, clear ALL ignore conditions for ALL dependencies in the group, open a new PR
@dependabot unignore DEPENDENCY_NAME Close current PR, clear all ignores for a specific dependency, open a new PR with its updates
@dependabot unignore DEPENDENCY_NAME IGNORE_CONDITION Close current PR, clear a specific ignore condition, open a new PR

Usage Examples

Merge After CI (Use Native GitHub Features)

Auto-merge is the recommended replacement for the deprecated @dependabot merge command:

# Enable auto-merge via GitHub CLI
gh pr merge <PR_NUMBER> --auto --squash

# Or enable auto-merge via the GitHub UI:
# PR → "Enable auto-merge" → select merge method → confirm

GitHub will automatically merge the PR once all required CI checks pass.

Ignore a Major Version Bump

@dependabot ignore this major version

Useful when a major version has breaking changes and migration is not yet planned.

Check Active Ignore Conditions

@dependabot show express ignore conditions

Displays a table showing all ignore conditions currently stored for the express dependency.

Unignore a Dependency in a Group

@dependabot unignore lodash

Closes the current grouped PR, clears all ignore conditions for lodash, and opens a new PR that includes available lodash updates.

Unignore a Specific Condition

@dependabot unignore express [< 1.9, > 1.8.0]

Clears only the specified version range ignore for express.

Tips

  • Rebase vs Recreate: Use rebase to resolve conflicts while keeping your review state. Use recreate to start fresh if the PR has diverged significantly.
  • Force push over extra commits: If you've pushed commits to a Dependabot branch and want Dependabot to rebase over them, include [dependabot skip] in your commit message.
  • Persistent ignores: Ignore commands via PR comments are stored centrally. For transparency in team repos, prefer using ignore in dependabot.yml instead.
  • Merging Dependabot PRs: Use GitHub's native auto-merge feature, the CLI (gh pr merge), or the web UI. The old @dependabot merge commands were deprecated in January 2026.
  • Closing/Reopening: Use the GitHub UI or CLI. The old @dependabot close and @dependabot reopen commands were deprecated in January 2026.
  • Grouped commands: When using @dependabot unignore, Dependabot closes the current PR and opens a fresh one with the updated dependency set.

Source: SKILL.md on GitHub

Third-party checks

No alerts17d4 checks · Risk SAFE
  • Gen Agent Trust Hub17d

    The skill is a comprehensive documentation and configuration guide for GitHub Dependabot. It provides reference material for creating `.github/dependabot.yml` files, managing pull requests, and utilizing the GitHub MCP Server for dependency scanning. All external references point to official GitHub resources, and no malicious patterns were identified.

  • Socket17d

    No alerts

  • Snyk17d

    Risk: LOW · No issues

  • ZeroLeaks5mo

    1 finding · Score: 86/100

Provenance

Signed by skilld at b87ca29. This ties the file your Agent reads to that commit on GitHub. It does not review the instructions.

Last checked against GitHub yesterday.

Activeupdated 4 months ago

Topics

  • dependabot
  • github
  • dependencies
  • security-updates
  • package-ecosystem
  • monorepo
  • automation
  • vulnerability
  • supply-chain

README badge

README badge for github/awesome-copilot/dependabot

What it does

Configures GitHub Dependabot for automated dependency updates and security alerts across npm, pip, Docker, GitHub Actions, and 20+ other ecosystems. Covers `.github/dependabot.yml` syntax, monorepo patterns, dependency grouping, security update strategies, and PR customization for reducing noise in large repositories.

Generated from the current SKILL.md.

Frequently asked

Can I have multiple dependabot.yml files in one repository?
No. GitHub supports exactly one file at `.github/dependabot.yml`. Use multiple `updates` entries within that file to configure different ecosystems and directories.
Does Dependabot support pnpm and yarn?
Yes. Both use `package-ecosystem: "npm"` — Dependabot automatically detects `pnpm-lock.yaml` and `yarn.lock` files.
How do I reduce the number of pull requests in a monorepo?
Use `groups` to batch related dependencies, `directories` with glob patterns to cover multiple package locations, and `group-by: dependency-name` to combine the same dependency updates across directories into a single PR.
What do the deprecated @dependabot merge and close commands do now?
As of January 2026, those commands are no longer supported. Use GitHub's native UI, the `gh pr merge` CLI command, or auto-merge instead.
Does this skill help configure Dependabot for AI coding agents?
This skill covers `.github/dependabot.yml` configuration and management. For pre-commit vulnerability scanning in AI agents, it references the GitHub Advanced Security plugin.

Generated from the current SKILL.md. These answers refresh after source changes.