SECURITY / GitHub community
Dependabot
Configures and manages Dependabot end to end: ecosystem detection across 25+ package managers, monorepo glob directories, grouped and multi-ecosystem updates, cooldown periods, ignore and allow rules, and PR command etiquette including the January 2026 deprecations.
“Comprehensive guide for configuring and managing GitHub Dependabot. …”
01 / THE REASONING
Why this made the selection.
- Covers the configuration surface teams actually trip on: plural directories with globs for monorepos versus the glob-less singular directory, grouped updates by type and name pattern, and cooldown periods that delay adopting freshly released versions.
- The multi-ecosystem-groups and group-by keys were cross-checked against GitHub's official Dependabot options reference during review — both are documented features and the skill's YAML matches the documented shapes.
- Current where it matters: it notes the January 2026 deprecation of merge, close and reopen PR commands and points at native auto-merge instead of teaching dead commands.
02 / THE REVIEW RECORD
What we actually inspected.
Source review has boundaries.
A clear record is more useful than a “safe” badge.
Material inspected
- skills/dependabot/SKILL.md (complete, 456 lines)
- skills/dependabot/references/dependabot-yml-reference.md (374 lines)
- repository LICENSE (MIT)
- GitHub official Dependabot options reference (external cross-check)
- skills/dependabot/SKILL.md
- vercel-labs/skills@7407f3893ad4dceab546ac002c3ef806e4000c73:README.md
- LICENSE
Our findings
- The ecosystem table covers 25+ managers including uv, bun, devcontainers and gitsubmodule, with the pnpm-and-yarn-under-npm and uv-over-pip precedence notes.
- The multi-ecosystem-groups and group-by: dependency-name keys were verified against the official docs.github.com Dependabot options reference and are documented features, not inventions.
- The skill states the allow-plus-ignore precedence rule (ignore wins) and that target-branch diverts version updates but not security updates, both matching the official reference.
- The guide calls for a separate ecosystem entry when a directory has its own lockfile outside the workspace; it also distinguishes version-update cooldown from security updates.
Not established by this review
- No dependabot.yml was installed in a repository and no Dependabot run was observed.
- Cooldown and grouping behaviour claims were verified against documentation, not against a live repository.
- Not executed: it was not installed or run.
The review applies to the material and revision named here. A newer upstream release can change its behavior.
03 / PUT IT TO WORK
Add a skill to your workflow.
DOCUMENTED COMMAND
npx skills add github/awesome-copilot/skills/dependabot --skill dependabotRun in your terminal to choose your AI tools, project or global scope, and installation method. This short command follows the current upstream version; the review covers the revision shown above.
Optional: install the reviewed revision
Keeps the original source and installer version where recorded, while leaving your AI tools and installation scope for you to choose.
npx skills add https://github.com/github/awesome-copilot/tree/7cce7cfb4b61196c36d7e8eb8475ae84b356b126/skills/dependabot --skill dependabot- Install the complete skill directory; the YAML reference and PR-command references are the substance.
- Point the agent at the repository's manifests; expect it to detect ecosystems, propose a dependabot.yml and suggest grouping and cooldown strategy.
Before you start
- Node.js/npm for the installer
- An agent that supports the Agent Skills format
- A GitHub repository with dependency manifests
04 / FOLLOW THE EVIDENCE
The source trail.
Our notes are separate from the original resource.
Check upstream before adopting a new version.
https://github.com/github/awesome-copilot/blob/7cce7cfb4b61196c36d7e8eb8475ae84b356b126/skills/dependabot/SKILL.md
Supports: summary, upstreamDescription, whySelected, bestFor, limitations, review, access
https://github.com/github/awesome-copilot/blob/7cce7cfb4b61196c36d7e8eb8475ae84b356b126/skills/dependabot/references/dependabot-yml-reference.md
Supports: review, whySelected, bestFor
- Repository licence (MIT) ↗Checked
https://github.com/github/awesome-copilot/blob/7cce7cfb4b61196c36d7e8eb8475ae84b356b126/LICENSE
Supports: license
https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference
Supports: review, whySelected
https://github.com/vercel-labs/skills/blob/7407f3893ad4dceab546ac002c3ef806e4000c73/README.md
Supports: install
https://raw.githubusercontent.com/github/awesome-copilot/7cce7cfb4b61196c36d7e8eb8475ae84b356b126/skills/dependabot/SKILL.md
Supports: review.findings, bestFor, upstreamDescription