Skip to main content
This guide explains how to enable and configure Dependabot version updates (in addition to security updates) so Dependabot will open pull requests to bump dependency versions when new releases are available. It also shows where to inspect Dependabot runs and logs. I enabled Dependabot version updates from the repository settings under Advanced Security. The Dependabot version updates feature uses a GitHub Actions–based workflow to detect available updates and open PRs.
A screenshot of a GitHub repository's Advanced Security settings page showing Dependabot alerts and related options (Dependabot rules, malware alerts, security updates, grouped updates) with enable/disable controls. The page is displayed in a dark-themed browser window with tabs visible along the top.

​
Add a dependabot.yml to your repo

Dependabot reads configuration from .github/dependabot.yml on the repository’s default branch. In this repository (Node.js, npm packages), I used version 2 of the configuration format and targeted the repository root (/) because package.json lives there. Create .github/dependabot.yml with the ecosystems, locations, schedule, limits, and reviewer assignments you want. Example used in this repository:
If you assign a team as a reviewer, use the exact format org/team-name (for example, game-devstudio/PC-Devs). Set open-pull-requests-limit to control noise by limiting concurrent Dependabot PRs.
Commit the file to the default branch (for example, main). Dependabot will run on the schedule you defined and open PRs when updates are detected.

​
Key configuration fields

For full options and advanced configuration (e.g., ignored versions, security updates only, or custom registries), see the official documentation: https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file

​
Inspect Dependabot activity and logs

Dependabot runs as a workflow (the updater action pulls container images and executes the update process). To review recent jobs and logs, navigate to: Insights → Dependency graph → Dependabot There you can view update job history and click “View logs” for details.
A screenshot of a GitHub repository's "Dependency graph" page in the Insights section, opened to the Dependabot tab. It shows a message "Update check processed," an "Export SBOM" button, and a section for Dependabot update logs with a "View logs" link.
A short excerpt from dependabot-action logs (the workflow that runs the updater):

​
Pull requests and merging

When Dependabot finds available updates, it opens pull requests that list the dependency bumps. You can review, test, and merge these PRs just like any other contribution. In the repository’s Pull Requests page you’ll see Dependabot-created PRs and any manual PRs created to support the updates.
A GitHub repository Pull Requests page shown in dark mode. It lists several open PRs (dependency bumps by dependabot and a restore app.js PR) with labels, filters, and a "New pull request" button.
After merging, the updated dependency versions appear in package.json (or the appropriate manifest/lockfile), and the commit history will show the merge commits from Dependabot.

​
Summary

  • Configure Dependabot version updates by adding .github/dependabot.yml to the repository default branch.
  • Define package-ecosystem, directory, schedule, open-pull-requests-limit, and reviewers in the YAML file.
  • Dependabot executes as a workflow, produces logs, and opens PRs for version bumps.
  • Use Insights → Dependency graph → Dependabot to inspect runs and logs.
  • Control how much noise Dependabot creates with open-pull-requests-limit and by assigning reviewers or using ignored updates.

Watch Video