Question

A platform team maintains a Node.js monorepo where Dependabot version updates are already enabled. Every week the team receives dozens of separate pull requests — one for each npm dependency that has a new release — which overwhelms reviewers and slows the merge queue. The team wants to keep receiving updates but consolidate related dependency bumps into a smaller number of pull requests per ecosystem. Which configuration change in dependabot.yml best achieves this?

Accepted Answer

Add a groups key under the npm package-ecosystem entry to bundle multiple dependency updates into combined pull requests

Answer

Set open-pull-requests-limit to 0 for the npm ecosystem to stop Dependabot from opening excess pull requests

Answer

Change the schedule interval from daily to weekly so all updates arrive in a single pull request

Answer

Enable Dependabot security updates instead of version updates so only vulnerable packages generate pull requests