You can enable Dependabot security updates for any repository that uses Dependabot alerts and the dependency graph. For more information, see "
About Dependabot security updates
."
You can enable or disable Dependabot security updates for an individual repository or for all repositories owned by your personal account or organization. For more information about enabling security features in an organization, see "
Quickstart for securing your organization
."
Note:
When Dependabot security updates are enabled for a repository, Dependabot will automatically try to open pull requests to resolve
every
open Dependabot alert that has an available patch. If you prefer to customize which alerts Dependabot opens pull requests for, you should leave Dependabot security updates
disabled
and create an auto-triage rule. For more information, see "
Customizing auto-triage rules to prioritize Dependabot alerts
."
Dependabot and all related features are covered by
GitHub's Terms of Service
.
GitHub automatically enables Dependabot security updates for newly created repositories if your personal account or organization has enabled
Automatically enable for new repositories
for Dependabot security updates. For more information, see "
Managing Dependabot security updates for your repositories
."
If you create a fork of a repository that has security updates enabled, GitHub will automatically disable Dependabot security updates for the fork. You can then decide whether to enable Dependabot security updates on the specific fork.
If security updates are not enabled for your repository and you don't know why, first try enabling them using the instructions given in the procedural sections below. If security updates are still not working, you can contact us through the
GitHub Support portal
.
You can enable or disable Dependabot security updates for all qualifying repositories owned by your personal account or organization. For more information, see "
Managing security and analysis settings for your personal account
" or "
Managing security and analysis settings for your organization
."
You can also enable or disable Dependabot security updates for an individual repository.
-
On GitHub.com, navigate to the main page of the repository.
-
Under your repository name, click
Settings
. If you cannot see the "Settings" tab, select the
dropdown menu, then click
Settings
.
-
In the "Security" section of the sidebar, click
Code security and analysis
.
-
Under "Code security and analysis", to the right of "Dependabot security updates", click
Enable
to enable the feature or
Disable
to disable it. For public repositories, the button is disabled if the feature is always enabled.
To reduce the number of pull requests you may be seeing, you can enable grouped security updates for your repository or organization. When this is enabled, Dependabot will group security updates into one pull request for each package ecosystem. In order to use grouped security updates, you must first enable the following features:
Note:
When grouped security updates are first enabled, Dependabot will immediately try to create grouped pull requests. You may notice Dependabot closing old pull requests and opening new ones.
You can enable grouped pull requests for Dependabot security updates in one, or both, of the following ways.
- To group as many available security updates together as possible, across directories and per ecosystem, enable grouping in the "Code security and analysis" settings for your organization or repository.
- For more granular control of grouping, such as grouping by package name, development/production dependencies, or SemVer level, add configuration options to the
dependabot.yml
configuration file in your repository.
Note:
If you have configured group rules for Dependabot security updates in a
dependabot.yml
file, all available updates will be grouped according to the rules you've specified. Dependabot will only group across those directories not configured in your
dependabot.yml
if the setting for grouped security updates at the organization or repository level is also enabled.
Repository administrators can enable or disable grouped security updates for their repository. Changing the repository setting will override any default organization settings. Group rules configured in a
dependabot.yml
file will override the user interface settings for enabling or disabling grouped security updates at the organization or repository level.
-
On GitHub.com, navigate to the main page of the repository.
-
Under your repository name, click
Settings
. If you cannot see the "Settings" tab, select the
dropdown menu, then click
Settings
.
-
In the "Security" section of the sidebar, click
Code security and analysis
.
-
Under "Code security and analysis", to the right of "Grouped security updates", click
Enable
to enable the feature or
Disable
to disable it.
Organization owners can enable or disable grouped security updates for all repositories in their organization. However, repository administrators within the organization can update the settings for their repositories to override the default organization settings. Group rules configured in a
dependabot.yml
file will override the user interface settings for enabling or disabling grouped security updates at the organization or repository level.
-
In the upper-right corner of GitHub, select your profile photo, then click
Your organizations
.
-
Next to the organization, click
Settings
.
-
In the "Security" section of the sidebar, click
Code security and analysis
.
Note
If your organization is enrolled in the security configurations and global settings public beta, instead of "Code security and analysis", you will see a "Code security" dropdown menu. Select
Code security
, then click
Global settings
. For next steps on enabling or disabling grouped Dependabot security updates in your organization with global settings, see "
Configuring global security settings for your organization
."
-
Under "Code security and analysis", to the right of "Grouped security updates", click
Disable all
or
Enable all
.
-
Optionally, to enable grouped Dependabot security updates for new repositories in your organization, select
Automatically enable for new repositories
.
You can override the default behavior of Dependabot security updates by adding a
dependabot.yml
file to your repository. With a
dependabot.yml
file, you can have more granular control of grouping, and override the default behavior of Dependabot security updates settings.
Use the
groups
option with the
applies-to: security-updates
key to create sets of dependencies (per package manager), so that Dependabot opens a single pull request to update multiple dependencies at the same time. You can define groups by package name (the
patterns
and
exclude-patterns
keys), dependency type (
dependency-type
key), and SemVer (the
update-types
key).
Dependabot creates groups in the order they appear in your
dependabot.yml
file. If a dependency update could belong to more than one group, it is only assigned to the first group it matches with.
If you only require
security
updates and want to exclude
version
updates, you can set
open-pull-requests-limit
to
0
in order to prevent version updates for a given
package-ecosystem
.
For more information about the configuration options available for security updates, see "
Configuration options for the dependabot.yml file
."
version:
2
registries:
example:
type:
npm-registry
url:
https://example.com
token:
${{secrets.NPM_TOKEN}}
updates:
-
package-ecosystem:
"npm"
directory:
"/src/npm-project"
schedule:
interval:
"daily"
ignore:
-
dependency-name:
"lodash"
open-pull-requests-limit:
0
registries:
-
example
-
package-ecosystem:
"gomod"
groups:
golang:
applies-to:
security-updates
patterns:
-
"golang.org*"
Note:
In order for Dependabot to use this configuration for security updates, the
directory
must be the path to the manifest files, and you should not specify a
target-branch
.