Dependabot Config Generator
Build a valid dependabot.yml — ecosystems, directories, schedules, groups and ignore rules — without memorizing the options reference.
Where the package manifests live (package.json, Gemfile, Dockerfile…), relative to the repository root — "/" means the root itself, not the lockfile's folder.
24-hour hh:mm. Without it, Dependabot picks a random time for the file's checks.
A tz database identifier for schedule.time, like Europe/Berlin. Without it the time is UTC.
How many open version-update PRs at once — the GitHub default is 5; 0 turns version updates off for this block.
Space- or comma-separated PR labels. Without this, Dependabot uses the repository's dependencies label.
Raise version-update PRs against this branch instead of the default branch.
daily checks every weekday (Monday to Friday), weekly once a week (Monday unless you pick a day), monthly on the first day of the month. The reference also documents quarterly, semiannually, yearly and cron — outside this generator's band.
The exact values from the GitHub options reference, each row cited and access-dated 2026-08-18 — a curated 17-value subset of the full upstream table.
Add at least one update block — the dependabot.yml text appears here.
Scrollable region — focus it and use the arrow keys.
This page only writes the file — nothing runs from this page. Dependabot reads .github/dependabot.yml on GitHub after you commit it there.
Ecosystem values curated from the GitHub Docs Dependabot options reference, accessed 2026-08-18; the full upstream table has more.
Press ? for shortcuts
Do it offline:$ git add .github/dependabot.yml
How to use it
- Add one update block per package ecosystem and manifest directory — npm at the root and github-actions beside it is the pair most repositories need.
- Pick the schedule: daily checks every weekday, weekly takes an optional day (Monday when you leave it unset), monthly runs on the first day of the month; time and timezone pin the clock.
- Tune the block: cap open pull requests, add labels, group dependencies into one PR with patterns, or ignore a dependency by name and version range.
- Copy or download the finished file and commit it as .github/dependabot.yml — the path GitHub reads it from.
Compose a version-2 dependabot.yml without re-reading the options reference: one update block per ecosystem and directory, a schedule in plain fields, then groups, ignore rules, labels and a PR limit where you want them. The YAML updates as you edit, with every ecosystem value cited to GitHub's own reference. Nothing runs from this page, and nothing you type leaves this device — you commit the file; Dependabot reads it on GitHub.
Examples
npm — weekly, monday 09:00 Europe/Berlinversion: 2
updates:
- package-ecosystem: "npm"
directory: "/"
schedule:
interval: "weekly"
day: "monday"
time: "09:00"
timezone: "Europe/Berlin"
schedule.time is 24-hour hh:mm and schedule.timezone is a tz database identifier; leave them out and Dependabot picks its own check time. The quoting matters — unquoted, some YAML parsers would not read 09:00 as text.
npm + github-actions — one dependabot.ymlversion: 2
updates:
- package-ecosystem: "npm"
directory: "/"
schedule:
interval: "weekly"
open-pull-requests-limit: 10
labels:
- "dependencies"
groups:
dev-dependencies:
patterns:
- "eslint*"
- "prettier"
- package-ecosystem: "github-actions"
directory: "/"
schedule:
interval: "monthly"
ignore:
- dependency-name: "actions/checkout"
versions:
- "4.x"
Two blocks, one file: package updates weekly and workflow-action updates monthly. The dev-dependencies group collects every eslint* package plus prettier into a single pull request, and actions/checkout stays parked on 4.x.
Every example on this page is executed against the same engine that powers the tool, on every build.
Gotchas worth knowing
directory points at the manifest, not the lockfile
The directory value is where the package manifests live — package.json, Gemfile, Dockerfile — relative to the repository root, with "/" meaning the root itself. In a monorepo, each package directory gets its own update block; a path that does not start from the root is refused here before it can silently match nothing.
One block per ecosystem + directory pair
GitHub requires update configurations to be unique and non-overlapping, so a second block for the same ecosystem and directory is refused with the earlier block named. The documented way to double up is target-branch: the same pair aimed at a different branch is a legal, separate configuration.
Groups cut pull-request noise
A group turns every dependency matching its patterns into one combined pull request instead of one PR each — * is the documented wildcard. The group name becomes a YAML map key under groups:, which is why two groups in one block cannot share a name.
Common errors
Update 2 (npm): update 1 already covers npm in "/" — the reference requires each combination to be unique; change the directory or the target-branch, or merge the blocks.- Duplicate ecosystem-and-directory pairs would collide on GitHub, so the file refuses to build while both exist. Merge the two blocks, or send one to another branch.
Update 1 (npm): schedule.day only customises the weekly interval — this block is daily. Remove the day, or switch the interval to weekly.- A weekday only makes sense for a once-a-week check. The picker hides the field outside weekly; a restored or hand-built form that still carries one is refused rather than silently ignored.
Update 1 (npm): directory "app" does not start with "/" — the path is resolved from the repository root, like "/" or "/app".- Manifest paths are resolved from the repository root. Writing app instead of /app is the most common hand-edit slip, so the refusal spells the fix.
Update 1 (npm): unknown timezone "Mars/Olympus" — use a tz database identifier like "Europe/Berlin" or "UTC".- schedule.timezone takes tz database names, checked against this device's own zone list. Abbreviations like CET are ambiguous and are not in that list.
FAQ
Where does the dependabot.yml file live?
In the .github directory at the repository root: .github/dependabot.yml, committed to the default branch. The command under the output card stages exactly that path. Once the file is on GitHub, Dependabot picks it up there — saving it here changes nothing until you commit and push it.
What is the difference between daily and weekly?
Per GitHub's reference, daily checks for updates every weekday, Monday to Friday; weekly checks once a week — on Monday unless schedule.day picks another weekday — and monthly runs on the first day of each month. Without a time, Dependabot chooses its own check time; set time (and a timezone) to pin it.
How do I stop updates for one dependency?
Add an ignore rule inside that ecosystem's block: dependency-name names the package, and versions optionally narrows the block to ranges like 4.x, so patch releases still arrive while a major stays parked. To pause version updates for a whole ecosystem instead, set open-pull-requests-limit to 0 — Dependabot security updates still open PRs for it.