> ## Documentation Index > Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt > Use this file to discover all available pages before exploring further. # Demo GHAS Dependabot Version Updates > Guide to enabling and configuring Dependabot version updates, creating dependabot.yml, inspecting runs and logs, and managing Dependabot pull request behavior This guide explains how to enable and configure Dependabot version updates (in addition to security updates) so Dependabot will open pull requests to bump dependency versions when new releases are available. It also shows where to inspect Dependabot runs and logs. I enabled Dependabot version updates from the repository settings under Advanced Security. The Dependabot version updates feature uses a GitHub Actions–based workflow to detect available updates and open PRs. ![A screenshot of a GitHub repository's Advanced Security settings page showing Dependabot alerts and related options (Dependabot rules, malware alerts, security updates, grouped updates) with enable/disable controls. The page is displayed in a dark-themed browser window with tabs visible along the top.](https://mintcdn.com/kodekloud-c4ac6d9a/TlnHw4JjIHBx3Cta/images/GitHub-Administration-Certification/Security-and-Compliance/Demo-GHAS-Dependabot-Version-Updates/github-advanced-security-dependabot-settings.jpg?fit=max\&auto=format\&n=TlnHw4JjIHBx3Cta\&q=85\&s=2b77c690a12a2af7214207896c37f4af) ## Add a dependabot.yml to your repo Dependabot reads configuration from `.github/dependabot.yml` on the repository's default branch. In this repository (Node.js, npm packages), I used version 2 of the configuration format and targeted the repository root (`/`) because `package.json` lives there. Create `.github/dependabot.yml` with the ecosystems, locations, schedule, limits, and reviewer assignments you want. Example used in this repository: ```yaml theme={null} # To get started with Dependabot version updates, you'll need to define # package ecosystems to update and where the package manifests or lockfiles are located. # Please see the documentation for all configuration options: version: 2 updates: - package-ecosystem: npm directory: / schedule: interval: weekly day: sunday time: "10:50" open-pull-requests-limit: 5 reviewers: - "game-devstudio/PC-Devs" ``` If you assign a team as a reviewer, use the exact format `org/team-name` (for example, `game-devstudio/PC-Devs`). Set `open-pull-requests-limit` to control noise by limiting concurrent Dependabot PRs. Commit the file to the default branch (for example, `main`). Dependabot will run on the schedule you defined and open PRs when updates are detected. ## Key configuration fields | Field | Purpose | Example | | - | - | - | | `package-ecosystem` | Select the package manager (npm, pip, maven, etc.) | `npm` | | `directory` | Where your manifest or lockfile lives in the repo | `/` | | `schedule` | How often to check for updates | `interval: weekly` / `day: sunday` / `time: "10:50"` | | `open-pull-requests-limit` | Max number of open Dependabot PRs at once | `5` | | `reviewers` | Users or teams to auto-request review | `"game-devstudio/PC-Devs"` | For full options and advanced configuration (e.g., ignored versions, security updates only, or custom registries), see the official documentation: [https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file](https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file) ## Inspect Dependabot activity and logs Dependabot runs as a workflow (the updater action pulls container images and executes the update process). To review recent jobs and logs, navigate to: Insights → Dependency graph → Dependabot There you can view update job history and click "View logs" for details. ![A screenshot of a GitHub repository's "Dependency graph" page in the Insights section, opened to the Dependabot tab. It shows a message "Update check processed," an "Export SBOM" button, and a section for Dependabot update logs with a "View logs" link.](https://mintcdn.com/kodekloud-c4ac6d9a/TlnHw4JjIHBx3Cta/images/GitHub-Administration-Certification/Security-and-Compliance/Demo-GHAS-Dependabot-Version-Updates/github-dependency-graph-dependabot-sbom-logs.jpg?fit=max\&auto=format\&n=TlnHw4JjIHBx3Cta\&q=85\&s=aab899da022d7bb55ee40ec813fe39fa) A short excerpt from dependabot-action logs (the workflow that runs the updater): ```text theme={null} 1 ▶ Run github/dependabot-action@main 9 🐙 ~ starting update ~ 10 Fetching job details 11 ▶ Pulling updater images 18 Starting update process 19 Created proxy container: 896cfd3b95f93cd33f7f9eb8849124492b2b20e95a14b3436e8c0120ac2d9a6d 20 proxy | 2026/08/23 10:49:38 proxy starting, commit: d5f00f37ca0f5c5810cfb3bc9574883b42df103d 21 proxy | 2026/08/23 10:49:38 Listening (:1080) 22 Created container: 73d54a47c0c1ac93b14fa97240f6b6c76336536a8f51d950d6067641ec660ac3 23 Started container 73d54a47c0c1ac93b14fa97240f6b6c76336536a8f51d950d6067641ec660ac3 24 updater | Updating certificates in /etc/ssl/certs... 25 updater | rehash: warning: skipping ca-certificates.crt,it does not contain exactly one certificate or CRL 26 updater | 1 added, 0 removed; done. 27 updater | Running hooks in /etc/ca-certificates/update.d... 28 updater | done. 29 updater | fetch_files command is no longer used directly 30 updater | 2026/08/23 10:49:41 INFO Starting job processing 31 updater | 2026/08/23 10:49:41 INFO Job definition: {"job":{"command":"version","allowed-updates":[{"dependency-type":"direct","update- ``` ## Pull requests and merging When Dependabot finds available updates, it opens pull requests that list the dependency bumps. You can review, test, and merge these PRs just like any other contribution. In the repository's Pull Requests page you'll see Dependabot-created PRs and any manual PRs created to support the updates. ![A GitHub repository Pull Requests page shown in dark mode. It lists several open PRs (dependency bumps by dependabot and a restore app.js PR) with labels, filters, and a "New pull request" button.](https://mintcdn.com/kodekloud-c4ac6d9a/TlnHw4JjIHBx3Cta/images/GitHub-Administration-Certification/Security-and-Compliance/Demo-GHAS-Dependabot-Version-Updates/github-pull-requests-dark-mode.jpg?fit=max\&auto=format\&n=TlnHw4JjIHBx3Cta\&q=85\&s=d5983fa8572d894e9426acec605f46f9) After merging, the updated dependency versions appear in `package.json` (or the appropriate manifest/lockfile), and the commit history will show the merge commits from Dependabot. ## Summary * Configure Dependabot version updates by adding `.github/dependabot.yml` to the repository default branch. * Define `package-ecosystem`, `directory`, `schedule`, `open-pull-requests-limit`, and `reviewers` in the YAML file. * Dependabot executes as a workflow, produces logs, and opens PRs for version bumps. * Use Insights → Dependency graph → Dependabot to inspect runs and logs. * Control how much noise Dependabot creates with `open-pull-requests-limit` and by assigning reviewers or using ignored updates. > [card] [Watch Video](https://learn.kodekloud.com/user/courses/github-administration-certification/module/d477d0b2-5ca0-43b2-aed7-7d82887400f7/lesson/9c07074e-97be-4c32-9fc1-41891d8b32ab) This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.