--- title: "Dependabot: review, setup & limitations · Undominated.ai" canonical: https://undominated.ai/skills/github-dependabot/ description: "Configures and manages Dependabot end to end: ecosystem detection across 25+ package managers, monorepo glob directories, grouped and multi-ecosystem updates, cooldown periods, ignore and allow rules, and PR command etiquette including the January 2026 deprecations." --- # Dependabot: review, setup & limitations · Undominated.ai > Configures and manages Dependabot end to end: ecosystem detection across 25+ package managers, monorepo glob directories, grouped and multi-ecosystem updates, cooldown periods, ignore and allow rules, and PR command etiquette including the January 2026 deprecations. [← Explore all skills](/skills/) SECURITY / GitHub community # Dependabot Configures and manages Dependabot end to end: ecosystem detection across 25+ package managers, monorepo glob directories, grouped and multi-ecosystem updates, cooldown periods, ignore and allow rules, and PR command etiquette including the January 2026 deprecations. [See setup guidance ↓](#setup)[Original source ↗](https://github.com/github/awesome-copilot/tree/7cce7cfb4b61196c36d7e8eb8475ae84b356b126/skills/dependabot) SOURCE REVIEW Reviewed 2026-10-15 Evidence 6 linked sources Publisher GitHub community Licence [MIT ↗](https://github.com/github/awesome-copilot/blob/7cce7cfb4b61196c36d7e8eb8475ae84b356b126/LICENSE) Revision 7cce7cfb4b61 [Read what was—and wasn’t—checked ↓](#review) “Comprehensive guide for configuring and managing GitHub Dependabot. …” [GitHub community · upstream description ↗](https://github.com/github/awesome-copilot/blob/7cce7cfb4b61196c36d7e8eb8475ae84b356b126/skills/dependabot/SKILL.md) Our analysis follows below. 01 / THE REASONING ## Why this made the selection. - Covers the configuration surface teams actually trip on: plural directories with globs for monorepos versus the glob-less singular directory, grouped updates by type and name pattern, and cooldown periods that delay adopting freshly released versions. - The multi-ecosystem-groups and group-by keys were cross-checked against GitHub's official Dependabot options reference during review — both are documented features and the skill's YAML matches the documented shapes. - Current where it matters: it notes the January 2026 deprecation of merge, close and reopen PR commands and points at native auto-merge instead of teaching dead commands. ### A good fit for - Writing or optimizing a dependabot.yml across multiple ecosystems - Reducing PR noise in a monorepo with grouped updates and glob directories - Setting cooldown periods so new releases are not adopted on day one - Separate standalone lockfile directories from workspace coverage when drafting dependency-update configuration. ### Weigh up before choosing - GitHub-product-specific: Renovate, GitLab dependency bots and other updaters share concepts but not this configuration surface. - The pre-commit scanning section routes to GitHub's MCP toolsets and the Advanced Security plugin, which need those tools installed and authenticated. - The feature surface moves fast — cooldowns and multi-ecosystem groups are recent additions — so the pinned revision will age against GitHub's changelog. 02 / THE REVIEW RECORD ## What we actually inspected. Source review has boundaries. A clear record is more useful than a “safe” badge. ### Material inspected - skills/dependabot/SKILL.md (complete, 456 lines) - skills/dependabot/references/dependabot-yml-reference.md (374 lines) - repository LICENSE (MIT) - GitHub official Dependabot options reference (external cross-check) - skills/dependabot/SKILL.md - vercel-labs/skills@7407f3893ad4dceab546ac002c3ef806e4000c73:README.md - LICENSE ### Our findings - The ecosystem table covers 25+ managers including uv, bun, devcontainers and gitsubmodule, with the pnpm-and-yarn-under-npm and uv-over-pip precedence notes. - The multi-ecosystem-groups and group-by: dependency-name keys were verified against the official docs.github.com Dependabot options reference and are documented features, not inventions. - The skill states the allow-plus-ignore precedence rule (ignore wins) and that target-branch diverts version updates but not security updates, both matching the official reference. - The guide calls for a separate ecosystem entry when a directory has its own lockfile outside the workspace; it also distinguishes version-update cooldown from security updates. ### Not established by this review - No dependabot.yml was installed in a repository and no Dependabot run was observed. - Cooldown and grouping behaviour claims were verified against documentation, not against a live repository. - Not executed: it was not installed or run. The review applies to the material and revision named here. A newer upstream release can change its behavior. 03 / PUT IT TO WORK ## Add a skill to your workflow. [Upstream setup instructions ↗](https://github.com/vercel-labs/skills/blob/7407f3893ad4dceab546ac002c3ef806e4000c73/README.md) DOCUMENTED COMMAND npx skills add github/awesome-copilot/skills/dependabot --skill dependabot Copy command ↗ Run in your terminal to choose your AI tools, project or global scope, and installation method. This short command follows the current upstream version; the review covers the revision shown above. Optional: install the reviewed revision Keeps the original source and installer version where recorded, while leaving your AI tools and installation scope for you to choose. npx skills add https://github.com/github/awesome-copilot/tree/7cce7cfb4b61196c36d7e8eb8475ae84b356b126/skills/dependabot --skill dependabot Copy reviewed-revision command ↗ - Install the complete skill directory; the YAML reference and PR-command references are the substance. - Point the agent at the repository's manifests; expect it to detect ecosystems, propose a dependabot.yml and suggest grouping and cooldown strategy. ### Before you start - Node.js/npm for the installer - An agent that supports the Agent Skills format - A GitHub repository with dependency manifests ### Compatibility Agent Skills-compatible coding agents · Repositories on GitHub configured via .github/dependabot.yml · Any of the 25+ supported package ecosystems ### Reads dependency manifests and workflows; writes dependabot.yml - Read package manifests, lockfiles and .github/workflows - Write or edit .github/dependabot.yml when authorized - No repository settings changes; enabling secret or security features stays in the GitHub UI ### Cost model MIT-licensed instruction package; Dependabot itself is a GitHub product feature with its own plan limits. 04 / FOLLOW THE EVIDENCE ## The source trail. Our notes are separate from the original resource. Check upstream before adopting a new version. - [Skill definition at reviewed revision ↗](https://github.com/github/awesome-copilot/blob/7cce7cfb4b61196c36d7e8eb8475ae84b356b126/skills/dependabot/SKILL.md) Checked 2026-10-07 https://github.com/github/awesome-copilot/blob/7cce7cfb4b61196c36d7e8eb8475ae84b356b126/skills/dependabot/SKILL.md Supports: summary, upstreamDescription, whySelected, bestFor, limitations, review, access - [Reference: complete dependabot.yml options (374 lines) ↗](https://github.com/github/awesome-copilot/blob/7cce7cfb4b61196c36d7e8eb8475ae84b356b126/skills/dependabot/references/dependabot-yml-reference.md) Checked 2026-10-07 https://github.com/github/awesome-copilot/blob/7cce7cfb4b61196c36d7e8eb8475ae84b356b126/skills/dependabot/references/dependabot-yml-reference.md Supports: review, whySelected, bestFor - [Repository licence (MIT) ↗](https://github.com/github/awesome-copilot/blob/7cce7cfb4b61196c36d7e8eb8475ae84b356b126/LICENSE) Checked 2026-10-07 https://github.com/github/awesome-copilot/blob/7cce7cfb4b61196c36d7e8eb8475ae84b356b126/LICENSE Supports: license - [GitHub official Dependabot options reference (external cross-check of multi-ecosystem-groups, group-by and cooldown) ↗](https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference) Checked 2026-10-07 https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference Supports: review, whySelected - [Skills installer source formats and selective installation ↗](https://github.com/vercel-labs/skills/blob/7407f3893ad4dceab546ac002c3ef806e4000c73/README.md) Checked 2026-10-07 https://github.com/vercel-labs/skills/blob/7407f3893ad4dceab546ac002c3ef806e4000c73/README.md Supports: install - [Pinned continuation review W16 ↗](https://raw.githubusercontent.com/github/awesome-copilot/7cce7cfb4b61196c36d7e8eb8475ae84b356b126/skills/dependabot/SKILL.md) Checked 2026-10-15 https://raw.githubusercontent.com/github/awesome-copilot/7cce7cfb4b61196c36d7e8eb8475ae84b356b126/skills/dependabot/SKILL.md Supports: review.findings, bestFor, upstreamDescription KEEP COMPARING ## Other approaches to consider. Related by category or shared topics. These are alternatives to inspect, not a measured quality order. [### Infisical secret scanning ↗ Infisical skill for scanning GitHub, GitLab, and Bitbucket history for leaked credentials, with GitHub tied to a github-radar connection and rotation required before history is rewritten.](/skills/infisical-secret-scanning/)[### Burp Project Parser ↗ Extract and search captured Burp traffic while distinguishing empty results from parser startup failures.](/skills/trailofbits-burpsuite-project-parser/)[### C and C++ Security Review ↗ Coordinate scoped native C/C++ security review and assemble findings with an explicit coverage ledger.](/skills/trailofbits-c-review/) [AI Tools ↗](/tools/)[Skills ↗](/skills/)[Agents ↗](/agents/)[MCP Servers ↗](/mcp-servers/)[Workflows ↗](/workflows/) ## Continue your investigation - [Choose a toolkit](/tools/) - [Inspect execution hosts](/agents/) - [Check tool access](/mcp-servers/) - [Check project dependencies](/check-repo/)