Question

Your team maintains a Node.js repository on GitHub. Security leadership requires that vulnerable dependencies be automatically patched as soon as a fix is published, but they also want to avoid the noise of routine, non-security version bump pull requests that currently overwhelm reviewers. You have a dependabot.yml file that enables the package-ecosystem for npm. Which configuration approach meets both requirements?

Accepted Answer

Disable Dependabot version updates (remove/omit the package-ecosystem schedule) and enable Dependabot security updates in the repository security settings, which raise PRs only for vulnerable dependencies.

Answer

Keep Dependabot version updates enabled in dependabot.yml, and rely on the automatically enabled Dependabot security updates (which require the dependency graph) to open PRs only for known vulnerabilities.

Answer

Remove the dependabot.yml file entirely and enable only Dependabot alerts, which will automatically open pull requests to patch vulnerabilities without any version-update noise.

Answer

Set schedule.interval to "daily" in dependabot.yml and add an ignore rule for every dependency, so only critical CVEs generate pull requests.