What is the dependabot.yml configuration file?

dependabot.yml is the YAML configuration file that controls Dependabot's version update behavior for a repository — declaring which package ecosystems to monitor, how often to check for updates, and various customization options (target branch, PR limits, ignored dependencies, and more).

version: 2
updates:
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "weekly"
    open-pull-requests-limit: 5

Every configuration starts with version: 2 (the current schema version) and an updates list, where each entry represents one package ecosystem/directory combination to monitor — a repository with both a Node.js frontend and a Python backend, for instance, would typically have two separate entries under updates, one per ecosystem.

Invest now in Acorns!!! 🚀
Join Acorns and get your $5 bonus!

Acorns is a micro-investing app that automatically invests your "spare change" from daily purchases into diversified, expert-built portfolios of ETFs. It is designed for beginners, allowing you to start investing with as little as $5. The service automates saving and investing. Disclosure: I may receive a referral bonus.

Invest now!!! Get Free equity stock (US, UK only)!

Use Robinhood app to invest in stocks. It is safe and secure. Use the Referral link to claim your free stock when you sign up!.

The Robinhood app makes it easy to trade stocks, crypto and more.

Webull! Receive free stock by signing up using the link: Webull signup.