--- title: Tame Dependabot: Group your updates, slow the cadence,... description: Dependabot's default configuration can flood repositories with individual pull requests for every dependency update. Using Microsoft's GCToolkit as a... canonical: https://daily.dev/posts/tame-dependabot-group-your-updates-slow-the-cadence-keep-security-fast-fjmrq4f6r twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Tame Dependabot: Group your updates, slow the cadence, keep security fast | daily.dev og:description: Dependabot's default configuration can flood repositories with individual pull requests for every dependency update. Using Microsoft's GCToolkit as a... og:url: https://daily.dev/posts/tame-dependabot-group-your-updates-slow-the-cadence-keep-security-fast-fjmrq4f6r og:image: https://api.daily.dev/og/posts/FJMrq4F6R.png og:image:alt: Tame Dependabot: Group your updates, slow the cadence, keep security fast og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Tame Dependabot: Group your updates, slow the cadence, keep security fast **[GitHub Blog](https://daily.dev/sources/ghblog)** · 10 min read · 1 upvotes · 0 comments ## Summary Dependabot's default configuration can flood repositories with individual pull requests for every dependency update. Using Microsoft's GCToolkit as a real-world example, this post shows how three changes to dependabot.yml dramatically reduce noise: grouping all updates into a single batched pull request per ecosystem using a wildcard pattern, slowing the check interval from daily to monthly, and ensuring every package ecosystem (not just github-actions) is covered. Critically, security updates remain unaffected by these changes — they still fire immediately upon vulnerability disclosure. A new default three-day cooldown period also now delays version-update PRs automatically, providing a buffer against supply chain attacks via freshly published malicious packages. The post includes actionable YAML examples and tips for monorepos using the directories key with group-by: dependency-name. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I stop Dependabot from opening a separate pull request for every dependency update? Add a groups block to your .github/dependabot.yml with a wildcard pattern, for example a group named monthly-batch with patterns set to "*". This bundles every available update for that ecosystem into a single pull request, branch, and CI run instead of one per dependency. You can also scope groups more narrowly, such as separating testing libraries from production dependencies. _Anyone tuning dependency workflows can track Dependabot configuration changes like this on daily.dev._ ### Does slowing Dependabot's update schedule to monthly delay security patches? No, Dependabot security updates are raised as soon as a vulnerability with a fix is disclosed, independent of the schedule.interval setting and separate from version-update groups. A monthly cadence only affects routine version bumps. Security updates can still be enabled via dependency graph and Dependabot alerts, and can even be grouped with applies-to: security-updates without slowing them down. _Teams balancing update noise against security response can follow this kind of guidance via daily.dev._ ### What is Dependabot's default cooldown period before opening a version-update pull request? Dependabot now waits at least three days after a new release appears on its registry before opening a version-update pull request, applied automatically with no configuration needed. This cooldown only affects version updates, not security updates, which still open immediately. The default-days value under the cooldown key in dependabot.yml can be raised, lowered, or disabled per semantic-versioning level. _Developers hardening dependency pipelines against bad releases can keep up with changes like this on daily.dev._ ## Similar posts on daily.dev - [Dependabot version updates introduce default package cooldown](https://daily.dev/posts/dependabot-version-updates-introduce-default-package-cooldown-lt7jppsaq) · GitHub Changelog · 1 upvotes · 1 comments - [Announcing Dependabot Configuration Enhancements: Cooldown and Group Support](https://daily.dev/posts/announcing-dependabot-configuration-enhancements-cooldown-and-group-support-6ungivtsj) · StepSecurity · 0 upvotes · 0 comments - [Turn Dependabot Off](https://daily.dev/posts/turn-dependabot-off-r3rqelf9d) · Filippo Valsorda · 19 upvotes · 9 comments - [Dependabot can group updates by dependency name across multiple directories](https://daily.dev/posts/dependabot-can-group-updates-by-dependency-name-across-multiple-directories-kyfvdcpj0) · GitHub Changelog · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#github-actions](https://daily.dev/tags/github-actions), [#maven](https://daily.dev/tags/maven), [#dependabot](https://daily.dev/tags/dependabot) [View this post on daily.dev](https://daily.dev/posts/tame-dependabot-group-your-updates-slow-the-cadence-keep-security-fast-fjmrq4f6r) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Tame Dependabot: Group your updates, slow the cadence, keep security fast","url":"https://daily.dev/posts/tame-dependabot-group-your-updates-slow-the-cadence-keep-security-fast-fjmrq4f6r","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/tame-dependabot-group-your-updates-slow-the-cadence-keep-security-fast-fjmrq4f6r"},"datePublished":"2026-07-29T16:01:11.967Z","dateModified":"2026-09-13T18:53:34.703Z","description":"Dependabot's default configuration can flood repositories with individual pull requests for every dependency update. Using Microsoft's GCToolkit as a...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d6886f9dbace2935f00cfe86fa0d7fb2?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d6886f9dbace2935f00cfe86fa0d7fb2?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"GitHub Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"GitHub Blog","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/106cf162b88840808484d4b5429b59b1","url":"https://daily.dev/sources/ghblog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/tame-dependabot-group-your-updates-slow-the-cadence-keep-security-fast-fjmrq4f6r","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,github-actions,maven,dependabot","timeRequired":"PT10M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"GitHub Blog","item":"https://daily.dev/sources/ghblog"},{"@type":"ListItem","position":3,"name":"Tame Dependabot: Group your updates, slow the cadence, keep security fast"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/tame-dependabot-group-your-updates-slow-the-cadence-keep-security-fast-fjmrq4f6r#faq","mainEntity":[{"@type":"Question","name":"How do I stop Dependabot from opening a separate pull request for every dependency update?","acceptedAnswer":{"@type":"Answer","text":"Add a groups block to your .github/dependabot.yml with a wildcard pattern, for example a group named monthly-batch with patterns set to \"*\". This bundles every available update for that ecosystem into a single pull request, branch, and CI run instead of one per dependency. You can also scope groups more narrowly, such as separating testing libraries from production dependencies. Anyone tuning dependency workflows can track Dependabot configuration changes like this on daily.dev."}},{"@type":"Question","name":"Does slowing Dependabot's update schedule to monthly delay security patches?","acceptedAnswer":{"@type":"Answer","text":"No, Dependabot security updates are raised as soon as a vulnerability with a fix is disclosed, independent of the schedule.interval setting and separate from version-update groups. A monthly cadence only affects routine version bumps. Security updates can still be enabled via dependency graph and Dependabot alerts, and can even be grouped with applies-to: security-updates without slowing them down. Teams balancing update noise against security response can follow this kind of guidance via daily.dev."}},{"@type":"Question","name":"What is Dependabot's default cooldown period before opening a version-update pull request?","acceptedAnswer":{"@type":"Answer","text":"Dependabot now waits at least three days after a new release appears on its registry before opening a version-update pull request, applied automatically with no configuration needed. This cooldown only affects version updates, not security updates, which still open immediately. The default-days value under the cooldown key in dependabot.yml can be raised, lowered, or disabled per semantic-versioning level. Developers hardening dependency pipelines against bad releases can keep up with changes like this on daily.dev."}}]} ```