Question

A platform team maintains a large Node.js monorepo where Dependabot opens dozens of separate pull requests each week for minor and patch updates across many npm packages. Reviewers are overwhelmed by the volume of individual PRs, and the team wants to consolidate related updates into fewer, batched pull requests while still keeping major version bumps separate for careful review. Which Dependabot configuration change best achieves this goal?

Accepted Answer

Add a `groups` block in dependabot.yml that groups npm dependencies by update-type (minor and patch), so batched updates arrive in a single pull request

Answer

Set `open-pull-requests-limit: 0` for the npm ecosystem to suppress the noisy pull requests entirely

Answer

Enable Dependabot security updates only and disable Dependabot version updates so fewer PRs are created

Answer

Configure a `schedule` with `interval: monthly` so all dependency updates are combined into one monthly pull request automatically