{"meta":{"title":"About the dependabot.yml file","intro":"The dependabot.yml controls automated dependency updates in your repository.","product":"Security and code quality","breadcrumbs":[{"href":"/en/code-security","title":"Security and code quality"},{"href":"/en/code-security/concepts","title":"Concepts"},{"href":"/en/code-security/concepts/supply-chain-security","title":"Supply chain security"},{"href":"/en/code-security/concepts/supply-chain-security/about-the-dependabot-yml-file","title":"dependabot.yml file"}],"documentType":"article"},"body":"# About the dependabot.yml file\n\nThe dependabot.yml controls automated dependency updates in your repository.\n\nThe `dependabot.yml` file is an optional configuration file that gives you fine-grained control over how Dependabot monitors and updates dependencies (mainly *version updates* but also *security updates*) in your repository.\n\nWithout a `dependabot.yml` file, Dependabot can still create security updates for vulnerable dependencies if you've enabled Dependabot security updates in your repository settings. However, you won't receive automated version updates or have control over update schedules and other configuration options.\n\nThe `dependabot.yml` file uses YAML syntax. If you're new to YAML and want to learn more, see [Learn YAML in five minutes](https://learnxinyminutes.com/yaml/).\n\n> \\[!NOTE]\n> Dependabot alerts are configured in the repository or organization \"Settings\" tab and not in the `dependabot.yml` file, see [Configuring Dependabot alerts](/en/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/configure-dependabot-alerts).\n\n## What the `dependabot.yml` file does\n\nThe `dependabot.yml` file controls how Dependabot performs updates on your dependencies. With this file, you can:\n\n### For version updates\n\n* Enable automated version updates\n* Specify which package ecosystems and directories to monitor\n* Set update schedules\n* Customize pull request labels, assignees, reviewers, and commit messages\n* Control which dependencies to update or ignore\n* Configure authentication for private registries\n\n### For security updates\n\n* Customize security update pull requests with labels, assignees, and reviewers\n* Define target branches for security updates\n* Configure private registry authentication\n* Set limits on open pull requests\n\n## Where to store the `dependabot.yml` file\n\nYou must store this file in the `.github` directory of your repository in the default branch (typically `main`), at `.github/dependabot.yml` or `.github/dependabot.yaml`.\n\n## How the `dependabot.yml` file works\n\nWhen you add or update the `dependabot.yml` file in your repository, Dependabot reads the configuration and begins monitoring the specified package ecosystems according to your defined schedules. When Dependabot finds available updates, it creates pull requests with the dependency changes, following any customization rules you've specified in the configuration.\n\nThe configuration file requires the following keys for each package ecosystem to monitor.\n\n* **`version`**: Top-level field that specifies the Dependabot configuration syntax version.\n* **`updates`**: Top-level section where you define each package ecosystem to monitor for updates.\n* **`package-ecosystem`**: Defined under `updates`, specifies which package manager to update (such as npm, pip, or Docker).\n* **`directories` or `directory`**: Defined under each `package-ecosystem` entry, specifies the location of manifest or dependency definition files.\n* **`schedule.interval`**: Defined under each `package-ecosystem` entry, sets how often to check for version updates (`daily`, `weekly`, or `monthly`).\n\n## Basic example\n\nHere's a minimal `dependabot.yml` file that monitors npm dependencies daily:\n\n```yaml copy\nversion: 2\nupdates:\n  - package-ecosystem: \"npm\"\n    directory: \"/\"\n    schedule:\n      interval: \"daily\"\n```\n\n## Next step\n\n* Configure your repository so that Dependabot automatically updates the packages you use, see [Configuring Dependabot version updates](/en/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/configure-version-updates)"}