Dependabot config generator — write .github/dependabot.yml

How to use the Dependabot config generator

1. Tick each ecosystem the repository uses. npm / Yarn / pnpm and GitHub Actions are ticked by default; others include pip, uv, Docker, Docker Compose, Go modules, Cargo, Composer, Bundler, Maven, Gradle, NuGet, Terraform and Bun.
2. Set the Manifest directory, the folder that holds package.json, requirements.txt or similar.
3. Pick a Schedule (Daily, Weekly, Monthly or Quarterly). Weekly also shows a Day. Time and Time zone are optional.
4. Adjust Open pull request limit, Group minor and patch updates into one PR, Cooldown days, Labels and Target branch if needed.
5. Save the result as .github/dependabot.yml on the default branch.

What it does and when to use it

Dependabot checks your dependency files on a schedule and opens pull requests when newer versions exist. The config file decides which ecosystems it watches, how often, and how noisy it may be. Use the generator for a new repository, or to replace an older file with a weekly, grouped setup that reviewers can keep up with.

Updates are only safe to merge if tests run on each pull request, so add a workflow from the GitHub Actions generator. The CODEOWNERS generator can route dependency pull requests to the right reviewers, and the commitlint config generator covers commit rules if you lint Dependabot’s commit messages too.

How it works

The file starts with version: 2 and an updates: list. Each ticked ecosystem gets its own entry with the same schedule and options:

• open-pull-requests-limit is written only when you change it from Dependabot’s default of 5;
• labels lists your comma-separated labels;
• cooldown: default-days appears when cooldown is above 0;
• grouping adds a minor-and-patch group with update-types minor and patch.

Key names follow the Dependabot options reference.

Worked examples

The default. npm and GitHub Actions, weekly on Monday, label dependencies, grouped. The first entry reads:

  - package-ecosystem: npm
    directory: /
    schedule:
      interval: weekly
      day: monday

The second entry is the same with package-ecosystem: github-actions.

A Python backend in a subfolder. pip and Docker, directory /backend, daily at 06:30 in Asia/Kolkata, limit 3, cooldown 7, labels deps, python, no grouping. Each entry contains time: "06:30", open-pull-requests-limit: 3 and default-days: 7.

Nothing ticked. The tool replies “Choose at least one package ecosystem.”

Limits and tips

• One directory applies to every ecosystem except GitHub Actions. For a monorepo with several manifest folders, copy an entry and change its directory.
• Private registries, ignore rules and version strategies are not generated; add them from the options reference.
• Labels that do not exist in the repository are ignored, so create them first.