Agent skill · marketing growth · github
dependabot
Comprehensive guide for configuring and managing GitHub Dependabot. Use this skill when users ask about creating or optimizing dependabot.yml files, managing Dependabot pull requests, configuring dependency update strategies, setting up grouped updates, monorepo patterns, multi-ecosystem groups, security update configuration, auto-triage rules, or any GitHub Advanced Security (GHAS) supply chain security topic related to Dependabot. For pre-commit dependency vulnerability scanning in AI coding agents via the GitHub MCP Server, this skill references the Advanced Security plugin (`advanced-security@copilot-plugins`). Use this skill when an agent needs to scan dependencies for known vulnerabilities before committing.
Why this skill is useful
Provides specific configuration patterns and strategies for managing Dependabot that the AI wouldn't reliably generate on its own.
What it needs
About 7k tokens when loaded. Last updated 2026-08-07. 37,534 stars on the source repository.
What this skill does
Dependabot Configuration & Management Overview Dependabot is GitHub's built-in dependency management tool with three core capabilities: 1. Dependabot Alerts — Notify when dependencies have known vulnerabilities (CVEs) 2. Dependabot Security Updates — Auto-create PRs to fix vulnerable dependencies 3. Dependabot Version Updates — Auto-create PRs to keep dependencies current All configuration lives in a single file: .github/dependabot.yml on the default branch. GitHub does not support multiple dependabot.yml files per repository. Configuration Workflow Follow this process when creating or optimizing a dependabot.yml: Step 1: Detect All Ecosystems Scan the repository for dependency manifests. Look for: Ecosystem YAML Value Manifest Files --- --- --- npm/pnpm/yarn npm package.json, package-lock.json, pnpm-lock.yaml, yarn.lock pip/pipenv/poetry pip requirements.txt, Pipfile, pyproject.toml, setup.py uv uv pyproject.toml, uv.lock Docker docker Dockerfile Docker Compose docker-compose docker-compose.yml GitHub Actions github-actions .github/workflows/.yml Go modules gomod go.mod Bundler (Ruby) bundler Gemfile Cargo (Rust) cargo Cargo.toml Composer (PHP) composer composer.json NuGet (.NET) nuget .csproj, packages.config .NET SDK dotnet-sdk global.json Maven (Java) maven pom.xml Gradle (Java) gradle build.gradle Terraform terraform .tf OpenTofu opentofu .tf Helm helm Chart.yaml Hex (Elixir) mix mix.exs Swift swift Package.swift Pub (Dart) pub pubspec.yaml Bun bun bun.lockb Dev Containers devcontainers devcontainer.json Git Submodules gitsubmodule .gitmodules Pre-commit pre-commit .pre-commit-config.yaml Notes: pnpm and yarn both use the npm ecosystem value. Prefer uv ecosystem value when uv.lock is present; otherwise use pip. Step 2: Map Directory Locations For each ecosystem, identify where manifests live. Use directories (plural) with glob patterns for monorepos: Important: directory (singular) does NOT support globs. Use directories (plural) for wildcards. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills github/dependabot