Skip to main content

Managing pull requests for dependency updates

You manage pull requests raised by Dependabot in much the same way as other pull requests, but there are some extra options.

About Dependabot pull requests

El Dependabot levanta solicitudes de extracción para actualizar las dependencias. Dependiendo de cómo se configure tu repositorio, el Dependabot podría levantar solicitudes de extracción para las actualizaciones de versión y/o para las alertas de seguridad. Administrarás estas solicitudes de la misma forma que cualquier otra solicitud de extracción, pero también hay comandos extra disponibles. Para obtener más información sobre cómo habilitar la actualización de dependencias del Dependabot, consulta las secciones "Configurar las Actualizaciones de seguridad del dependabot" y "Habilitar e inhabilitar la actualización de versiones del Dependabot".

When Dependabot raises a pull request, you're notified by your chosen method for the repository. Each pull request contains detailed information about the proposed change, taken from the package manager. These pull requests follow the normal checks and tests defined in your repository. In addition, where enough information is available, you'll see a compatibility score. This may also help you decide whether or not to merge the change. For information about this score, see "About Actualizaciones de seguridad del dependabot."

If you have many dependencies to manage, you may want to customize the configuration for each package manager so that pull requests have specific reviewers, assignees, and labels. For more information, see "Customizing dependency updates."

Viewing Dependabot pull requests

  1. En GitHub.com, visita la página principal del repositorio.
  2. Debajo del nombre de tu repositorio, da clic en Solicitudes de cambios. Selección de la pestaña de propuestas y solicitudes de extracción
  3. Any pull requests for security or version updates are easy to identify.
    • The author is dependabot, the bot account used by Dependabot.
    • By default, they have the dependencies label.

Changing the rebase strategy for Dependabot pull requests

By default, Dependabot automatically rebases pull requests to resolve any conflicts. If you'd prefer to handle merge conflicts manually, you can disable this using the rebase-strategy option. For details, see "Configuration options for dependency updates."

Managing Dependabot pull requests with comment commands

Dependabot responds to simple commands in comments. Each pull request contains details of the commands you can use to process the pull request (for example: to merge, squash, reopen, close, or rebase the pull request) under the "Dependabot commands and options" section. The aim is to make it as easy as possible for you to triage these automatically generated pull requests.

You can use any of the following commands on a Dependabot pull request.

  • @dependabot cancel merge cancels a previously requested merge.
  • @dependabot close closes the pull request and prevents Dependabot from recreating that pull request. You can achieve the same result by closing the pull request manually.
  • @dependabot ignore this dependency closes the pull request and prevents Dependabot from creating any more pull requests for this dependency (unless you reopen the pull request or upgrade to the suggested version of the dependency yourself).
  • @dependabot ignore this major version closes the pull request and prevents Dependabot from creating any more pull requests for this major version (unless you reopen the pull request or upgrade to this major version yourself).
  • @dependabot ignore this minor version closes the pull request and prevents Dependabot from creating any more pull requests for this minor version (unless you reopen the pull request or upgrade to this minor version yourself).
  • @dependabot merge merges the pull request once your CI tests have passed.
  • @dependabot rebase rebases the pull request.
  • @dependabot recreate recreates the pull request, overwriting any edits that have been made to the pull request.
  • @dependabot reopen reopens the pull request if the pull request is closed.
  • @dependabot squash and merge squashes and merges the pull request once your CI tests have passed.

Dependabot will react with a "thumbs up" emoji to acknowledge the command, and may respond with a comment on the pull request. While Dependabot usually responds quickly, some commands may take several minutes to complete if Dependabot is busy processing other updates or commands.

If you run any of the commands for ignoring dependencies or versions, Dependabot stores the preferences for the repository centrally. While this is a quick solution, for repositories with more than one contributor it is better to explicitly define the dependencies and versions to ignore in the configuration file. This makes it easy for all contributors to see why a particular dependency isn't being updated automatically. For more information, see "Configuration options for dependency updates."