Dependabot Config Generator
Generate .github/dependabot.yml for npm, Composer, pip, Go, Docker, GitHub Actions and more, with a schedule, grouped minor and patch updates and an open PR limit.
Free · No sign-up · Your inputs stay in your browser
Input
Generate a Dependabot configuration
Output
.github/dependabot.yml
934 characters
Grouping minor and patch updates turns a dozen weekly PRs into one, which is the difference between a team that merges them and one that ignores them; majors still arrive one at a time because they need reading. Keep github-actions in the list: pinned action versions go stale too. Set directory to each manifest's folder in a monorepo (or use directories with globs).
Runs in this browser. Nothing you paste is sent to a server.
About this tool
Method, assumptions, practical next steps, and limits.
Grouping makes it usable
One pull request per dependency per week is noise that teams learn to ignore, and ignored updates become a security backlog. Groups bundle minor and patch updates into one PR, so the routine updates get merged and majors, which need reading, arrive separately. The options are documented in GitHub's Dependabot options reference.
Do not forget Actions
Workflow files pin actions to versions that age like any dependency. The github-actions ecosystem keeps them current.