Dependabot's default configuration can flood repositories with individual pull requests for every dependency update. Using Microsoft's GCToolkit as a real-world example, this post shows how three changes to dependabot.yml dramatically reduce noise: grouping all updates into a single batched pull request per ecosystem using a wildcard pattern, slowing the check interval from daily to monthly, and ensuring every package ecosystem (not just github-actions) is covered. Critically, security updates remain unaffected by these changes — they still fire immediately upon vulnerability disclosure. A new default three-day cooldown period also now delays version-update PRs automatically, providing a buffer against supply chain attacks via freshly published malicious packages. The post includes actionable YAML examples and tips for monorepos using the directories key with group-by: dependency-name.
