Customizing pull requests for Dependabot security updates

Learn how to customize Dependabot pull requests for security updates to align with your project's security priorities and workflows.

Preparing to customize pull requests

If you haven't yet configured a dependabot.yml file for your repository and you want to customize pull requests for security updates, you must first:

  1. Check in a dependabot.yml file into the .github directory of your repository. For more information, see Configuring Dependabot version updates.
  2. Set all the required keys. For more information, see Required keys.
  3. If you want the customization for a package ecosystem to only apply to security updates (and exclude version updates), set the open-pull-requests-limit key to 0.

You can then consider what your needs and priorities are for security updates, and apply a combination of the customization options outlined below.

Prioritizing meaningful updates

To create a more targeted review process that prioritizes meaningful updates, use groups to combine security updates for multiple dependencies into a single pull request.

For detailed guidance, see Prioritizing meaningful updates.

Automatically adding assignees

Use assignees to automatically add individuals or teams as assignees to pull requests.

For detailed guidance, see Automatically adding assignees.

Automatically adding reviewers

To ensure your project's security updates get addressed promptly by the appropriate team, you can automatically add reviewers to Dependabot pull requests using a CODEOWNERS file. See About code owners.

Labeling pull requests with custom labels

To prioritize specific pull requests, or integrate them into CI/CD pipelines, use labels to apply your own custom labels to each pull request.

For detailed guidance, see Labeling pull requests with custom labels.

Adding a prefix to commit messages

To integrate with automations that process commit messages or pull requests titles, use commit-message to specify the prefix that you want for commit messages and pull request titles.

For detailed guidance, see Adding a prefix to commit messages.

Associating pull requests with a milestone

To track progress towards a project goal or release, use milestone to associate Dependabot's pull requests with a milestone.

For detailed guidance, see Associating pull requests with a milestone.

Customizing pull request branch names

To ensure your branch names align with your team's existing conventions, use pull-request-branch-name to customize how Dependabot generates branch names—including the separator, prefix, length, casing, and format.

For detailed guidance, see Customizing pull request branch names.

Example 1: configuration for security updates only

In this example, the dependabot.yml file:

# Example configuration file that:
#  - Uses a private registry for npm updates
#  - Ignores lodash dependency
#  - Disables version-updates
#  - Applies custom labels
#  - Adds assignees
#  - Group security updates for golang dependencies into a single pull request

version: 2
registries:
  # Define a private npm registry with the name `example`
  example:
    type: npm-registry
    url: https://example.com
    token: ${{secrets.NPM_TOKEN}}
updates:
  - package-ecosystem: "npm"
    directory: "/src/npm-project"
    schedule:
      interval: "daily"
    # For Lodash, ignore all updates
    ignore:
      - dependency-name: "lodash"
    # Disable version updates for npm dependencies
    open-pull-requests-limit: 0
    registries:
      # Ask Dependabot to use the private registry for npm
      - example
    # Raise all npm pull requests for security updates with custom labels
    labels:
      - "npm dependencies"
      - "triage-board"
    # Raise all npm pull requests for security updates with assignees
    assignees:
      - "user-name"
  - package-ecosystem: "gomod"
    directories:
      - "**/*"
    schedule:
      interval: "weekly"
    open-pull-requests-limit: 0
    groups:
      # Group security updates for golang dependencies
      # into a single pull request
      golang:
        applies-to: security-updates
        patterns:
          - "golang.org*"

Example 2: configuration for version updates and security updates

In this example, the dependabot.yml file:

version: 2
updates:
  # Keep npm dependencies up to date
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "weekly"
# Raise all npm pull requests for security and version updates with custom labels
    labels:
      - "npm dependencies"
      - "triage-board"
    groups:
      angular:
        # Group security updates for Angular dependencies into a single pull request
        applies-to: security-updates
        patterns:
          - "@angular*"
      production-dependencies:
        # Group version updates for dependencies of type "production" into a single pull request
        applies-to: version-updates
        dependency-type: "production"

Further reading