Question

A platform team wants Dependabot to keep their npm dependencies current by opening pull requests on a weekly schedule for all outdated packages, not only for those with known vulnerabilities. They already receive Dependabot alerts and automatic security update PRs. Which additional configuration must they add to achieve the weekly update behavior?

Accepted Answer

Add a .github/dependabot.yml file with a top-level `updates:` entry for the npm package-ecosystem on a weekly schedule interval

Answer

Enable Dependabot security updates at the organization level, which will begin opening PRs for all outdated dependencies weekly

Answer

Turn on the dependency graph, since that automatically raises version-update PRs for every ecosystem it detects

Answer

Configure a branch protection rule that requires Dependabot to update dependencies before merging any pull request