Loading page
About this tool
Generate a valid .github/dependabot.yml with package ecosystems, update schedules, grouped PRs and ignore rules.
This generator builds a valid .github/dependabot.yml file — the version 2 configuration GitHub's Dependabot reads to open automated dependency-update pull requests. Pick your package ecosystems (npm, pip, Docker, Go modules, Maven and more), set daily, weekly or monthly schedules, group minor and patch bumps into one PR, and ignore major versions, then copy the ready-to-commit YAML.
Open Dependabot Config Generator on AltFTool — it loads instantly in your browser.
Provide your input — an image, text, or data.
Let the tool analyze or generate the result.
Review, refine, and reuse the output wherever you need it.
Emits version 2 YAML with the exact keys Dependabot validates: package-ecosystem, directory and schedule.interval.
One click adds a groups block for minor and patch updates and an ignore rule for semver-major bumps.
Covers all 18 public package-ecosystem values, with duplicate ecosystem + directory pairs caught before you commit.
At .github/dependabot.yml on your repository's default branch. Dependabot reads it automatically once committed — there is no separate enable step for version updates, though your organisation can also turn Dependabot on or off in repository security settings.
Five open pull requests per update entry when the key is omitted. Setting it to 0 disables version-update PRs for that entry while leaving Dependabot security updates active, and you can raise it to any value up to 99 if you want more parallel PRs.
Add a groups block to the update entry. Grouping by update-types "minor" and "patch" — which this generator emits with one checkbox — makes Dependabot combine all minor and patch bumps for that ecosystem into a single pull request, while major updates still arrive individually.
Yes. An ignore rule with dependency-name "*" and update-types "version-update:semver-major" suppresses every major-version PR for that entry; minor and patch updates continue as scheduled. You can also ignore specific packages by name instead of the wildcard if only a few dependencies are pinned.