dependabot

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Dependabot Configuration & Management

Dependabot 配置与管理

Overview

概述

Dependabot is GitHub's built-in dependency management tool with three core capabilities:

Dependabot Alerts — Notify when dependencies have known vulnerabilities (CVEs)
Dependabot Security Updates — Auto-create PRs to fix vulnerable dependencies
Dependabot Version Updates — Auto-create PRs to keep dependencies current

All configuration lives in a single file:

.github/dependabot.yml

on the default branch. GitHub does not support multiple

dependabot.yml

files per repository.

Dependabot 是 GitHub 内置的依赖项管理工具，具有三项核心能力：

Dependabot Alerts — 在依赖项存在已知漏洞（CVE）时发出通知
Dependabot Security Updates — 自动创建 PR 以修复存在漏洞的依赖项
Dependabot Version Updates — 自动创建 PR 以使依赖项保持最新

所有配置都位于默认分支上的单个文件：

.github/dependabot.yml

。GitHub 不支持每个仓库使用多个

dependabot.yml

文件。

Configuration Workflow

配置工作流

Follow this process when creating or optimizing a

dependabot.yml

创建或优化

dependabot.yml

时，请遵循以下流程：

Step 1: Detect All Ecosystems

第 1 步：检测所有 package ecosystem

Scan the repository for dependency manifests. Look for:

Ecosystem	YAML Value	Manifest Files
npm/pnpm/yarn	`npm`	`package.json` , `package-lock.json` , `pnpm-lock.yaml` , `yarn.lock`
pip/pipenv/poetry	`pip`	`requirements.txt` , `Pipfile` , `pyproject.toml` , `setup.py`
uv	`uv`	`pyproject.toml` , `uv.lock`
Docker	`docker`	`Dockerfile`
Docker Compose	`docker-compose`	`docker-compose.yml`
GitHub Actions	`github-actions`	`.github/workflows/*.yml`
Go modules	`gomod`	`go.mod`
Bundler (Ruby)	`bundler`	`Gemfile`
Cargo (Rust)	`cargo`	`Cargo.toml`
Composer (PHP)	`composer`	`composer.json`
NuGet (.NET)	`nuget`	`*.csproj` , `packages.config`
.NET SDK	`dotnet-sdk`	`global.json`
Maven (Java)	`maven`	`pom.xml`
Gradle (Java)	`gradle`	`build.gradle`
Terraform	`terraform`	`*.tf`
OpenTofu	`opentofu`	`*.tf`
Helm	`helm`	`Chart.yaml`
Hex (Elixir)	`mix`	`mix.exs`
Swift	`swift`	`Package.swift`
Pub (Dart)	`pub`	`pubspec.yaml`
Bun	`bun`	`bun.lockb`
Dev Containers	`devcontainers`	`devcontainer.json`
Git Submodules	`gitsubmodule`	`.gitmodules`
Pre-commit	`pre-commit`	`.pre-commit-config.yaml`

Notes:

pnpm and yarn both use the
```
npm
```
ecosystem value.
Prefer
```
uv
```
ecosystem value when
```
uv.lock
```
is present; otherwise use
```
pip
```
.

扫描仓库中的 dependency manifest。查找：

package ecosystem	YAML 值	Manifest 文件
npm/pnpm/yarn	`npm`	`package.json` , `package-lock.json` , `pnpm-lock.yaml` , `yarn.lock`
pip/pipenv/poetry	`pip`	`requirements.txt` , `Pipfile` , `pyproject.toml` , `setup.py`
uv	`uv`	`pyproject.toml` , `uv.lock`
Docker	`docker`	`Dockerfile`
Docker Compose	`docker-compose`	`docker-compose.yml`
GitHub Actions	`github-actions`	`.github/workflows/*.yml`
Go modules	`gomod`	`go.mod`
Bundler (Ruby)	`bundler`	`Gemfile`
Cargo (Rust)	`cargo`	`Cargo.toml`
Composer (PHP)	`composer`	`composer.json`
NuGet (.NET)	`nuget`	`*.csproj` , `packages.config`
.NET SDK	`dotnet-sdk`	`global.json`
Maven (Java)	`maven`	`pom.xml`
Gradle (Java)	`gradle`	`build.gradle`
Terraform	`terraform`	`*.tf`
OpenTofu	`opentofu`	`*.tf`
Helm	`helm`	`Chart.yaml`
Hex (Elixir)	`mix`	`mix.exact`
Swift	`swift`	`Package.swift`
Pub (Dart)	`pub`	`pubspec.yaml`
Bun	`bun`	`bun.lockb`
Dev Containers	`devcontainers`	`devcontainer.json`
Git Submodules	`gitsubmodule`	`.gitmodules`
Pre-commit	`pre-commit`	`.pre-commit-config.yaml`

注意：

pnpm 和 yarn 都使用
```
npm
```
ecosystem 值。
存在
```
uv.lock
```
时，优先使用
```
uv
```
ecosystem 值；否则使用
```
pip
```
。

Step 2: Map Directory Locations

第 2 步：映射目录位置

For each ecosystem, identify where manifests live. Use

directories

(plural) with glob patterns for monorepos:

yaml

directories:
  - "/"           # root
  - "/apps/*"     # all app subdirs
  - "/packages/*" # all package subdirs
  - "/lib-*"      # dirs starting with lib-
  - "**/*"        # recursive (all subdirs)

Important:

directory

(singular) does NOT support globs. Use

directories

(plural) for wildcards.

对于每个 package ecosystem，确定 manifest 所在位置。对于 monorepo，使用带 glob 模式的

directories

（复数）：

yaml

directories:
  - "/"           # root
  - "/apps/*"     # all app subdirs
  - "/packages/*" # all package subdirs
  - "/lib-*"      # dirs starting with lib-
  - "**/*"        # recursive (all subdirs)

重要提示：

directory

（单数）不支持 glob。对于通配符，请使用

directories

（复数）。

Step 3: Configure Each Ecosystem Entry

第 3 步：配置每个 ecosystem 条目

Every entry needs at minimum:

yaml

- package-ecosystem: "npm"
  directory: "/"
  schedule:
    interval: "weekly"

每个条目至少需要：

yaml

- package-ecosystem: "npm"
  directory: "/"
  schedule:
    interval: "weekly"

Step 4: Optimize with Grouping, Labels, and Scheduling

第 4 步：通过分组、标签和调度进行优化

See sections below for each optimization technique.

有关各项优化技术，请参阅以下章节。

Monorepo Strategies

Monorepo 策略

Glob Patterns for Workspace Coverage

覆盖工作区的 Glob 模式

For monorepos with many packages, use glob patterns to avoid listing each directory:

yaml

- package-ecosystem: "npm"
  directories:
    - "/"
    - "/apps/*"
    - "/packages/*"
    - "/services/*"
  schedule:
    interval: "weekly"

对于包含许多 package 的 monorepo，使用 glob 模式可以避免逐个列出目录：

yaml

- package-ecosystem: "npm"
  directories:
    - "/"
    - "/apps/*"
    - "/packages/*"
    - "/services/*"
  schedule:
    interval: "weekly"

Cross-Directory Grouping

跨目录分组

Use

group-by: dependency-name

to create a single PR when the same dependency updates across multiple directories:

yaml

groups:
  monorepo-deps:
    group-by: dependency-name

This creates one PR per dependency across all specified directories, reducing CI costs and review burden.

Limitations:

All directories must use the same package ecosystem
Applies to version updates only
Incompatible version constraints create separate PRs

当同一依赖项在多个目录中更新时，使用

group-by: dependency-name

创建单个 PR：

yaml

groups:
  monorepo-deps:
    group-by: dependency-name

这样，所有指定目录中的同一依赖项更新会合并为一个 PR，从而降低 CI 成本和审查负担。

限制：

所有目录必须使用相同的 package ecosystem
仅适用于版本更新
不兼容的版本约束会生成单独的 PR

Standalone Packages Outside Workspaces

Workspace 之外的独立 Package

If a directory has its own lockfile and is NOT part of the workspace (e.g., scripts in

.github/

), create a separate ecosystem entry for it.

如果某个目录有自己的 lockfile，且不属于 workspace（例如

.github/

中的脚本），请为它创建独立的 ecosystem 条目。

Dependency Grouping

依赖项分组

Reduce PR noise by grouping related dependencies into single PRs.

通过将相关依赖项分组到单个 PR 中，减少 PR 干扰。

By Dependency Type

按依赖项类型分组

yaml

groups:
  dev-dependencies:
    dependency-type: "development"
    update-types: ["minor", "patch"]
  production-dependencies:
    dependency-type: "production"
    update-types: ["minor", "patch"]

yaml

groups:
  dev-dependencies:
    dependency-type: "development"
    update-types: ["minor", "patch"]
  production-dependencies:
    dependency-type: "production"
    update-types: ["minor", "patch"]

By Name Pattern

按名称模式分组

yaml

groups:
  angular:
    patterns: ["@angular*"]
    update-types: ["minor", "patch"]
  testing:
    patterns: ["jest*", "@testing-library*", "ts-jest"]

yaml

groups:
  angular:
    patterns: ["@angular*"]
    update-types: ["minor", "patch"]
  testing:
    patterns: ["jest*", "@testing-library*", "ts-jest"]

For Security Updates

用于安全更新

yaml

groups:
  security-patches:
    applies-to: security-updates
    patterns: ["*"]
    update-types: ["patch", "minor"]

Key behaviors:

Dependencies matching multiple groups go to the first match
```
applies-to
```
defaults to
```
version-updates
```
when absent
Ungrouped dependencies get individual PRs

yaml

groups:
  security-patches:
    applies-to: security-updates
    patterns: ["*"]
    update-types: ["patch", "minor"]

关键行为：

匹配多个组的依赖项会进入第一个匹配的组
未指定时，
```
applies-to
```
默认为
```
version-updates
```
未分组的依赖项会各自生成一个 PR

Multi-Ecosystem Groups

多生态系统分组

Combine updates across different package ecosystems into a single PR:

yaml

version: 2

multi-ecosystem-groups:
  infrastructure:
    schedule:
      interval: "weekly"
    labels: ["infrastructure", "dependencies"]

updates:
  - package-ecosystem: "docker"
    directory: "/"
    patterns: ["nginx", "redis"]
    multi-ecosystem-group: "infrastructure"

  - package-ecosystem: "terraform"
    directory: "/"
    patterns: ["aws*"]
    multi-ecosystem-group: "infrastructure"

The

patterns

key is required when using

multi-ecosystem-group

将不同 package ecosystem 的更新合并到单个 PR：

yaml

version: 2

multi-ecosystem-groups:
  infrastructure:
    schedule:
      interval: "weekly"
    labels: ["infrastructure", "dependencies"]

updates:
  - package-ecosystem: "docker"
    directory: "/"
    patterns: ["nginx", "redis"]
    multi-ecosystem-group: "infrastructure"

  - package-ecosystem: "terraform"
    directory: "/"
    patterns: ["aws*"]
    multi-ecosystem-group: "infrastructure"

使用

multi-ecosystem-group

时必须设置

patterns

键。

PR Customization

PR 自定义

Labels

Commit Messages

提交消息

yaml

commit-message:
  prefix: "deps"
  prefix-development: "deps-dev"
  include: "scope"  # adds deps/deps-dev scope after prefix

yaml

commit-message:
  prefix: "deps"
  prefix-development: "deps-dev"
  include: "scope"  # adds deps/deps-dev scope after prefix

Assignees and Milestones

负责人和里程碑

yaml

assignees: ["security-team-lead"]
milestone: 4  # numeric ID from milestone URL

yaml

assignees: ["security-team-lead"]
milestone: 4  # numeric ID from milestone URL

Branch Name Separator

分支名称分隔符

yaml

pull-request-branch-name:
  separator: "-"  # default is /

yaml

pull-request-branch-name:
  separator: "-"  # default is /

Target Branch

目标分支

yaml

target-branch: "develop"  # PRs target this instead of default branch

Note: When

target-branch

is set, security updates still target the default branch; all ecosystem config only applies to version updates.

yaml

target-branch: "develop"  # PRs target this instead of default branch

注意：设置

target-branch

后，安全更新仍会指向默认分支；所有 ecosystem 配置仅适用于版本更新。

Schedule Optimization

调度优化

Intervals

更新间隔

Supported:

daily

weekly

monthly

quarterly

semiannually

yearly

cron

yaml

schedule:
  interval: "weekly"
  day: "monday"         # for weekly only
  time: "09:00"         # HH:MM format
  timezone: "America/New_York"

支持的间隔：

daily

、

weekly

、

monthly

、

quarterly

、

semiannually

、

yearly

、

cron

yaml

schedule:
  interval: "weekly"
  day: "monday"         # for weekly only
  time: "09:00"         # HH:MM format
  timezone: "America/New_York"

Cron Expressions

Cron 表达式

yaml

schedule:
  interval: "cron"
  cronjob: "0 9 * * 1"  # Every Monday at 9 AM

yaml

schedule:
  interval: "cron"
  cronjob: "0 9 * * 1"  # Every Monday at 9 AM

Cooldown Periods

Cooldown 周期

Delay updates for newly released versions to avoid early-adopter issues:

yaml

cooldown:
  default-days: 5
  semver-major-days: 30
  semver-minor-days: 7
  semver-patch-days: 3
  include: ["*"]
  exclude: ["critical-lib"]

Cooldown applies to version updates only, not security updates.

延迟新发布版本的更新，以避免早期采用者遇到问题：

yaml

cooldown:
  default-days: 5
  semver-major-days: 30
  semver-minor-days: 7
  semver-patch-days: 3
  include: ["*"]
  exclude: ["critical-lib"]

Cooldown 仅适用于版本更新，不适用于安全更新。

Security Updates Configuration

安全更新配置

Enable via Repository Settings

通过仓库设置启用

Settings → Advanced Security → Enable Dependabot alerts, security updates, and grouped security updates.

Settings → Advanced Security → 启用 Dependabot alerts、security updates 和 grouped security updates。

Group Security Updates in YAML

在 YAML 中对安全更新进行分组

yaml

groups:
  security-patches:
    applies-to: security-updates
    patterns: ["*"]
    update-types: ["patch", "minor"]

yaml

groups:
  security-patches:
    applies-to: security-updates
    patterns: ["*"]
    update-types: ["patch", "minor"]

Disable Version Updates (Security Only)

禁用版本更新（仅使用安全更新）

yaml

open-pull-requests-limit: 0  # disables version update PRs

yaml

open-pull-requests-limit: 0  # disables version update PRs

Auto-Triage Rules

Auto-Triage 规则

GitHub presets auto-dismiss low-impact alerts for development dependencies. Custom rules can filter by severity, package name, CWE, and more. Configure in repository Settings → Advanced Security.

GitHub 预设会自动关闭开发依赖项的低影响警报。自定义规则可按严重性、软件包名称、CWE 等条件进行筛选。在仓库的 Settings → Advanced Security 中配置。

PR Comment Commands

PR 评论命令

Interact with Dependabot PRs using

@dependabot

comments.

Note: As of January 2026, merge/close/reopen commands have been deprecated. Use GitHub's native UI, CLI (
gh pr merge
), or auto-merge instead.

Command	Effect
`@dependabot rebase`	Rebase the PR
`@dependabot recreate`	Recreate the PR from scratch
`@dependabot ignore this dependency`	Close and never update this dependency
`@dependabot ignore this major version`	Ignore this major version
`@dependabot ignore this minor version`	Ignore this minor version
`@dependabot ignore this patch version`	Ignore this patch version

For grouped PRs, additional commands:

```
@dependabot ignore DEPENDENCY_NAME
```
— ignore specific dependency in group
```
@dependabot unignore DEPENDENCY_NAME
```
— clear ignores, reopen with updates
```
@dependabot unignore *
```
— clear all ignores for all dependencies in group

@dependabot show DEPENDENCY_NAME ignore conditions

— display current ignores

For the complete command reference, see

references/pr-commands.md

使用

@dependabot

评论与 Dependabot PR 交互。

注意： 截至 2026 年 1 月，merge/close/reopen 命令已被弃用。请改用 GitHub 原生 UI、CLI（
gh pr merge
）或 auto-merge。

命令	效果
`@dependabot rebase`	对 PR 执行 rebase
`@dependabot recreate`	从头重新创建 PR
`@dependabot ignore this dependency`	关闭该 PR，且此后不再更新此依赖项
`@dependabot ignore this major version`	忽略该 major 版本
`@dependabot ignore this minor version`	忽略该 minor 版本
`@dependabot ignore this patch version`	忽略该 patch 版本

对于分组 PR，还支持以下命令：

```
@dependabot ignore DEPENDENCY_NAME
```
— 忽略组内特定依赖项
```
@dependabot unignore DEPENDENCY_NAME
```
— 清除忽略设置，并随更新重新打开 PR
```
@dependabot unignore *
```
— 清除组内所有依赖项的忽略设置

@dependabot show DEPENDENCY_NAME ignore conditions

— 显示当前忽略条件

有关完整的命令参考，请参阅

references/pr-commands.md

。

Ignore and Allow Rules

Ignore 和 Allow 规则

Ignore Specific Dependencies

忽略特定依赖项

yaml

ignore:
  - dependency-name: "lodash"
  - dependency-name: "@types/node"
    update-types: ["version-update:semver-patch"]
  - dependency-name: "express"
    versions: ["5.x"]

yaml

ignore:
  - dependency-name: "lodash"
  - dependency-name: "@types/node"
    update-types: ["version-update:semver-patch"]
  - dependency-name: "express"
    versions: ["5.x"]

Allow Only Specific Types

仅允许特定类型

yaml

allow:
  - dependency-type: "production"
  - dependency-name: "express"

Rule: If a dependency matches both

allow

and

ignore

, it is ignored.

yaml

allow:
  - dependency-type: "production"
  - dependency-name: "express"

规则：如果依赖项同时匹配

allow

和

ignore

，则会被忽略。

Exclude Paths

排除路径

yaml

exclude-paths:
  - "vendor/**"
  - "test/fixtures/**"

yaml

exclude-paths:
  - "vendor/**"
  - "test/fixtures/**"

Advanced Options

高级选项

Versioning Strategy

版本约束策略

Controls how Dependabot edits version constraints:

Value	Behavior
`auto`	Default — increase for apps, widen for libraries
`increase`	Always increase minimum version
`increase-if-necessary`	Only change if current range excludes new version
`lockfile-only`	Only update lockfiles, ignore manifests
`widen`	Widen range to include both old and new versions

控制 Dependabot 如何编辑版本约束：

值	行为
`auto`	默认——对应用提高版本约束，对库放宽版本约束
`increase`	始终提高最低版本
`increase-if-necessary`	仅当当前范围不包含新版本时才更改
`lockfile-only`	仅更新 lockfile，不更新 manifest
`widen`	放宽范围，以同时包含旧版本和新版本

Rebase Strategy

Rebase 策略

yaml

rebase-strategy: "disabled"  # stop auto-rebasing

Allow rebase over extra commits by including

[dependabot skip]

in commit messages.

yaml

rebase-strategy: "disabled"  # stop auto-rebasing

通过在提交消息中包含

[dependabot skip]

，允许在额外提交之上执行 rebase。

Open PR Limit

打开的 PR 数量上限

yaml

open-pull-requests-limit: 10  # default is 5 for version, 10 for security

Set to

to disable version updates entirely.

yaml

open-pull-requests-limit: 10  # default is 5 for version, 10 for security

版本更新的默认值为 5，安全更新的默认值为 10。

设为

可完全禁用版本更新。

Private Registries

私有 Registry

yaml

registries:
  npm-private:
    type: npm-registry
    url: https://npm.example.com
    token: ${{secrets.NPM_TOKEN}}

updates:
  - package-ecosystem: "npm"
    directory: "/"
    registries:
      - npm-private

yaml

registries:
  npm-private:
    type: npm-registry
    url: https://npm.example.com
    token: ${{secrets.NPM_TOKEN}}

updates:
  - package-ecosystem: "npm"
    directory: "/"
    registries:
      - npm-private

FAQ

Can I have multiple
dependabot.yml
files? No. GitHub supports exactly one file at

.github/dependabot.yml

. Use multiple

updates

entries within that file for different ecosystems and directories.

Does Dependabot support pnpm? Yes. Use

package-ecosystem: "npm"

— Dependabot detects

pnpm-lock.yaml

automatically.

How do I reduce PR noise in a monorepo? Use

groups

to batch updates,

directories

with globs for coverage, and

group-by: dependency-name

for cross-directory grouping. Consider

monthly

quarterly

intervals for low-priority ecosystems.

How do I handle dependencies outside the workspace? Create a separate ecosystem entry with its own

directory

pointing to that location.

我能有多个
dependabot.yml
文件吗？不能。GitHub 仅支持在

.github/dependabot.yml

放置一个文件。对于不同的 package ecosystem 和目录，请在该文件内使用多个

updates

条目。

Dependabot 支持 pnpm 吗？ 支持。使用

package-ecosystem: "npm"

即可——Dependabot 会自动检测

pnpm-lock.yaml

。

如何减少 monorepo 中的 PR 干扰？ 使用

groups

批量处理更新，使用带 glob 的

directories

覆盖工作区，并使用

group-by: dependency-name

进行跨目录分组。对于低优先级 ecosystem，可以考虑使用

monthly

或

quarterly

间隔。

如何处理 workspace 之外的依赖项？ 创建一个独立的 ecosystem 条目，并使用指向该位置的

directory

。

Pre-Commit Dependency Scanning via AI Coding Agents

通过 AI 编程 Agent 进行 Pre-Commit 依赖项扫描

For scanning code changes for vulnerable dependencies inside an AI coding agent before committing, the GitHub MCP Server's

dependabot

toolset can check your dependency additions against the GitHub Advisory Database and return structured results with affected packages, severity, and recommended fixed versions. For more thorough post-commit checks, it can also run the Dependabot CLI locally to diff dependency graphs before and after your changes.

Install the Advanced Security plugin which provides dedicated dependency scanning tools and the

/dependency-scanning

skill.

GitHub Copilot CLI (shell):

bash

undefined

若要在提交前通过 AI 编程 Agent 扫描代码变更中的漏洞依赖项，GitHub MCP Server 的

dependabot

toolset 可以根据 GitHub Advisory Database 检查新增的依赖项，并返回结构化结果，其中包含受影响的软件包、严重性以及建议修复版本。对于更全面的提交后检查，它还可以在本地运行 Dependabot CLI，对比更改前后的 dependency graph。

安装 Advanced Security plugin，该 plugin 提供专用的依赖项扫描工具和

/dependency-scanning

skill。

GitHub Copilot CLI（shell）：

bash

undefined

Enable the dependabot toolset for the GitHub MCP Server

copilot --add-github-mcp-toolset dependabot


**GitHub Copilot CLI (inside `copilot`):**
```text
> /plugin install advanced-security@copilot-plugins

Visual Studio Code:

Add
```
"X-MCP-Toolsets": "dependabot"
```
to your GitHub MCP Server headers, or pick Dependabot from the toolset selector in Copilot Chat
Install the
```
advanced-security
```
plugin, then use
```
/dependency-scanning
```
in Copilot Chat

Example prompt:

Scan the dependencies I added on this branch for known vulnerabilities and tell me which versions to upgrade to before I commit.

See: Advanced Security Plugin — Dependency Scanning Skill

Announced in Dependency scanning with GitHub MCP Server is in public preview (May 2026)

copilot --add-github-mcp-toolset dependabot


**GitHub Copilot CLI（在 `copilot` 中）：**
```text
> /plugin install advanced-security@copilot-plugins

Visual Studio Code：

将
```
"X-MCP-Toolsets": "dependabot"
```
添加到 GitHub MCP Server 请求头中，或者在 Copilot Chat 的 toolset selector 中选择 Dependabot
安装
```
advanced-security
```
plugin，然后在 Copilot Chat 中使用
```
/dependency-scanning
```

示例提示词：

请扫描我在此分支上添加的依赖项，找出已知漏洞，并告诉我提交前应升级到哪些版本。

参见：Advanced Security plugin — Dependency Scanning Skill

公布于通过 GitHub MCP Server 进行依赖项扫描现已公开预览（2026 年 5 月）

Resources

资源

```
references/dependabot-yml-reference.md
```
— Complete YAML options reference
```
references/pr-commands.md
```
— Full PR comment commands reference
```
references/example-configs.md
```
— Real-world configuration examples

```
references/dependabot-yml-reference.md
```
— 完整的 YAML 选项参考
```
references/pr-commands.md
```
— 完整的 PR 评论命令参考
```
references/example-configs.md
```
— 实际配置示例