{"id":97770,"date":"2026-07-29T09:00:00","date_gmt":"2026-07-29T16:00:00","guid":{"rendered":"https:\/\/github.blog\/?p=97770"},"modified":"2026-07-28T13:45:31","modified_gmt":"2026-07-28T20:45:31","slug":"tame-dependabot-group-your-updates-slow-the-cadence-keep-security-fast","status":"publish","type":"post","link":"https:\/\/github.blog\/security\/supply-chain-security\/tame-dependabot-group-your-updates-slow-the-cadence-keep-security-fast\/","title":{"rendered":"Tame Dependabot: Group your updates, slow the cadence, keep security fast"},"content":{"rendered":"\n

If you maintain an active repository, you know the feeling. You open your notifications on a Monday morning and there they are: five, 10, sometimes a dozen Dependabot pull requests, each bumping a single dependency by a single patch version. Individually, every one of them is helpful. Collectively, they’re noise. And noise is how important updates get ignored.<\/p>\n\n\n\n

We looked at Microsoft’s GCToolkit<\/a>, an open source Java library for analyzing garbage collection logs. As of July 2026, a git log<\/code> of the repository showed that 92 of its 578 commits, roughly one in six, were Dependabot version bumps<\/strong>, with 61 in the previous 12 months alone, sometimes several in a single day. That’s a lot of review, merge, and CI cycles spent on routine maintenance.<\/p>\n\n\n\n

The good news: Dependabot already ships with the features to fix this. In a recent pull request<\/a>, the project changed its dependabot.yml<\/code> in three small but meaningful ways, turning a daily drip of single-dependency pull requests into a predictable, grouped, monthly batch per ecosystem. Here’s what changed, why it works, and how to apply the same pattern to your own repositories, following the GCToolkit example.<\/p>\n\n\n\n

The problem: Good defaults, wrong cadence<\/h2>\n\n\n\n

Here’s what GCToolkit’s configuration looked like before:<\/p>\n\n\n

\n
version: 2\nupdates:\n- package-ecosystem: github-actions\n  directory: \"\/\"\n  schedule:\n    interval: daily\n  open-pull-requests-limit: 10<\/code><\/pre>\n<\/path><\/path><\/svg><\/path><\/svg><\/clipboard-copy><\/div>\n\n\n
This is a common starting point, but the daily<\/code> interval here was a deliberate choice, not a default: schedule.interval<\/code> is required, and GitHub’s suggested starter template<\/a> uses weekly<\/code>. Two things make this configuration noisy:<\/p>\n\n\n\n