dependabot

Dependabot is GitHub's built-in dependency management tool with three core capabilities: All configuration lives in a single file : .github/dependabot.yml on the default branch. GitHub does not support multiple dependabot.yml files per repository. Follow this process when creating or optimizing a dependabot.yml : Scan the repository for dependency manifests. Look for: Note: pnpm and yarn both use the npm ecosystem value. For each ecosystem, identify where manifests live. Use directories (plural) with glob patterns for monorepos: Important: directory (singular) does NOT support globs. Use directories (plural) for wildcards. Every entry needs at minimum: See sections below for each optimization technique.