A dozen Dependabot pull requests on a Monday morning is how important updates get ignored. On Microsoft's GCToolkit, roughly one in six commits were single-dependency version bumps.
Three small changes to dependabot.yml fixed it 👇
- A dozen Dependabot pull requests on a Monday morning is how important updates get ignored. On Microsoft's GCToolkit, roughly one in six commits were single-dependency version bumps. Three small changes to dependabot.yml fixed it 👇
Grouped updates should be the default like with Renovate.
Our weekly dependency upgrade PR updates hundreds of dependencies in one batch. If we configured dependabot to open a PR per dependency we would have drowned in the noise 😂
@github Underrated point — dependency fatigue is a security problem, not just a maintenance one. Teams start ignoring PRs the moment volume outpaces signal. Grouping updates isn't just cleaner, it forces you to actually review what's changing instead of rubber-stamping green