How can I change my dependabot config to exclude major versions

Question

This is my dependabot config, is there any way to exclude major version updates and just have minor, patch and security updates? If so what would I need to change?

version: 1
update_configs:
  - package_manager: 'javascript'
    commit_message:
      include_scope: true
      prefix: 'chore'
    default_reviewers:
      - someUser
    default_labels:
      - 'dependencies'
    directory: '/'
    target_branch: 'develop'
    update_schedule: 'live'

Currently, by the documentation (https://dependabot.com/docs/config-file/#ignored_updates), the only way to ignore major updates is per dependency name, not globally. — Gabriel Caruso, Apr 12 '20 at 12:26
It's possible now -> https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuring-dependabot-version-updates#example-disabling-version-updates-for-some-dependencies — Bala.Raj, Apr 27 '22 at 10:00

score 7 · Answer 1 · answered Jun 22 '22 at 15:59

This is now possible although you'll need to update to Dependabot version 2. You can then do something like the following:

version: 2
updates:
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "daily"
    ignore:
      - dependency-name: "*"
        update-types: ["version-update:semver-major"]

See https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#ignore for more information on this.

score 2 · Answer 2 · answered Sep 24 '20 at 08:22

You can do something like this. We use this to ignore certain versions of certain dependencies.

- package-ecosystem: gomod
  directory: "/"
  schedule:
    interval: daily
    time: "04:00"
  open-pull-requests-limit: 10
  reviewers:
  - xh3b4sd
  ignore:
  - dependency-name: k8s.io/*
    versions:
    - ">=0.19.0"

One problem that I currently try to figure out is how to actually resume updates automatically once they have been ignored. Right now it looks like you have to trigger them manually, which is quite some work when you have many repositories.

How can I change my dependabot config to exclude major versions

2 Answers2