AutoBotShelf
Runs: Every week

Keep your project's dependencies up to date automatically

Each week GitHub opens pull requests that bump your outdated packages and GitHub Actions, so updates arrive small and often instead of all at once.

Dependencies go stale quietly until an upgrade becomes a project. Dependabot is built into GitHub and only needs one small file to start sending you weekly update pull requests.

  1. Create the config file

    In your repository on GitHub, click Add file, then Create new file, and name it .github/dependabot.yml. It has to be in the .github folder on your default branch.

  2. Say what to update and how often

    Paste this. It covers npm packages and the GitHub Actions in your workflows; swap npm for your package manager if you use another, such as pip, bundler or gomod:

    version: 2
updates:
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "weekly"
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"

  3. Commit it

    Click Commit changes. Dependabot checks shortly afterwards and then once a week, opening a pull request for each outdated dependency.

  4. Review and merge the pull requests

    Let your tests run on each pull request and merge the ones that pass. Small weekly updates are much easier to review than a year's worth at once.

Things that trip people up

  • Without tests running on pull requests, you're merging updates blind. Make sure CI runs on them.
  • A repository with many dependencies can get a lot of pull requests at first. Grouping updates (in the agent version) keeps it manageable.