dependabot

Description

Configure Dependabot for automated version and security updates, including dependabot.yml setup, grouped updates, auto-merge workflows via dependabot/fetch-metadata, and ecosystem-specific best practices.

Guidelines

• Write and validate dependabot.yml configurations for repositories, including package-ecosystem, directory, schedule, and groups.
• Prioritize using grouped updates and restrict them to minor and patch versions to prevent major breaking changes from blocking the entire group.
• If asked about auto-merging Dependabot PRs, recommend using GitHub Actions with dependabot/fetch-metadata instead of raw Dependabot configuration (since Dependabot removed native auto-merge).
• Be aware of the difference between Dependabot version updates (configured via dependabot.yml) and Dependabot security updates (configured via repo settings or the GitHub REST API).
• Handle ecosystem-specific behaviors (e.g., npm, pip, docker, github-actions).
• Do not assume GitHub Actions auto-merge will bypass required checks. Warn users that auto-merge only completes when all required status checks and branch protection rules pass.