[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6ADFNRD5B20AT64FJM7Q87V":3,"skill-same:01M6ADFNRD5B20AT64FJM7Q87V":87},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":49,"commitSha":50,"skillDirectory":51,"forksCount":52,"repositoryHtmlUrl":53,"repositoryHomepageUrl":54,"ownerHtmlUrl":55,"ownerBlogUrl":56,"ownerDescription":57,"updatedAt":58,"install":59,"resources":72},"01M6ADFNRD5B20AT64FJM7Q87V","dependabot",null,"Comprehensive guide for configuring and managing GitHub Dependabot. Use this skill when users ask about creating or optimizing dependabot.yml files, managing Dependabot pull requests, configuring dependency update strategies, setting up grouped updates, monorepo patterns, multi-ecosystem groups, security update configuration, auto-triage rules, or any GitHub Advanced Security (GHAS) supply chain security topic related to Dependabot. For pre-commit dependency vulnerability scanning in AI coding agents via the GitHub MCP Server, this skill references the Advanced Security plugin (`advanced-security@copilot-plugins`). Use this skill when an agent needs to scan dependencies for known vulnerabilities before committing.","github\u002Fawesome-copilot","github","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F9919?v=4","01M6AC83DS133TPXFSP1DHNCC6","GitHub","01M6AD3PBDYPK7NVFJNJ66Y8RS",41081,"MIT","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fdependabot\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[5,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"coding","chain security","supply chain","users","pre-commit","Rules","use","scan","for","supply","guide","security","strategies","auto","files","monorepo","update","server","pull requests","MCP","2026-11-10 10:12:30",false,"---\nname: dependabot\ndescription: >-\n  Comprehensive guide for configuring and managing GitHub Dependabot. Use this skill when\n  users ask about creating or optimizing dependabot.yml files, managing Dependabot pull requests,\n  configuring dependency update strategies, setting up grouped updates, monorepo patterns,\n  multi-ecosystem groups, security update configuration, auto-triage rules, or any GitHub\n  Advanced Security (GHAS) supply chain security topic related to Dependabot. For pre-commit\n  dependency vulnerability scanning in AI coding agents via the GitHub MCP Server, this skill\n  references the Advanced Security plugin (`advanced-security@copilot-plugins`). Use this skill\n  when an agent needs to scan dependencies for known vulnerabilities before committing.\n---\n\n# Dependabot Configuration & Management\n\n## Overview\n\nDependabot is GitHub's built-in dependency management tool with three core capabilities:\n\n1. **Dependabot Alerts** — Notify when dependencies have known vulnerabilities (CVEs)\n2. **Dependabot Security Updates** — Auto-create PRs to fix vulnerable dependencies\n3. **Dependabot Version Updates** — Auto-create PRs to keep dependencies current\n\nAll configuration lives in a **single file**: `.github\u002Fdependabot.yml` on the default branch. GitHub does **not** support multiple `dependabot.yml` files per repository.\n\n## Configuration Workflow\n\nFollow this process when creating or optimizing a `dependabot.yml`:\n\n### Step 1: Detect All Ecosystems\n\nScan the repository for dependency manifests. Look for:\n\n| Ecosystem | YAML Value | Manifest Files |\n|---|---|---|\n| npm\u002Fpnpm\u002Fyarn | `npm` | `package.json`, `package-lock.json`, `pnpm-lock.yaml`, `yarn.lock` |\n| pip\u002Fpipenv\u002Fpoetry | `pip` | `requirements.txt`, `Pipfile`, `pyproject.toml`, `setup.py` |\n| uv | `uv` | `pyproject.toml`, `uv.lock` |\n| Docker | `docker` | `Dockerfile` |\n| Docker Compose | `docker-compose` | `docker-compose.yml` |\n| GitHub Actions | `github-actions` | `.github\u002Fworkflows\u002F*.yml` |\n| Go modules | `gomod` | `go.mod` |\n| Bundler (Ruby) | `bundler` | `Gemfile` |\n| Cargo (Rust) | `cargo` | `Cargo.toml` |\n| Composer (PHP) | `composer` | `composer.json` |\n| NuGet (.NET) | `nuget` | `*.csproj`, `packages.config` |\n| .NET SDK | `dotnet-sdk` | `global.json` |\n| Maven (Java) | `maven` | `pom.xml` |\n| Gradle (Java) | `gradle` | `build.gradle` |\n| Terraform | `terraform` | `*.tf` |\n| OpenTofu | `opentofu` | `*.tf` |\n| Helm | `helm` | `Chart.yaml` |\n| Hex (Elixir) | `mix` | `mix.exs` |\n| Swift | `swift` | `Package.swift` |\n| Pub (Dart) | `pub` | `pubspec.yaml` |\n| Bun | `bun` | `bun.lockb` |\n| Dev Containers | `devcontainers` | `devcontainer.json` |\n| Git Submodules | `gitsubmodule` | `.gitmodules` |\n| Pre-commit | `pre-commit` | `.pre-commit-config.yaml` |\n\nNotes:\n- pnpm and yarn both use the `npm` ecosystem value.\n- Prefer `uv` ecosystem value when `uv.lock` is present; otherwise use `pip`.\n\n### Step 2: Map Directory Locations\n\nFor each ecosystem, identify where manifests live. Use `directories` (plural) with glob patterns for monorepos:\n\n```yaml\ndirectories:\n  - \"\u002F\"           # root\n  - \"\u002Fapps\u002F*\"     # all app subdirs\n  - \"\u002Fpackages\u002F*\" # all package subdirs\n  - \"\u002Flib-*\"      # dirs starting with lib-\n  - \"**\u002F*\"        # recursive (all subdirs)\n```\n\nImportant: `directory` (singular) does NOT support globs. Use `directories` (plural) for wildcards.\n\n### Step 3: Configure Each Ecosystem Entry\n\nEvery entry needs at minimum:\n\n```yaml\n- package-ecosystem: \"npm\"\n  directory: \"\u002F\"\n  schedule:\n    interval: \"weekly\"\n```\n\n### Step 4: Optimize with Grouping, Labels, and Scheduling\n\nSee sections below for each optimization technique.\n\n## Monorepo Strategies\n\n### Glob Patterns for Workspace Coverage\n\nFor monorepos with many packages, use glob patterns to avoid listing each directory:\n\n```yaml\n- package-ecosystem: \"npm\"\n  directories:\n    - \"\u002F\"\n    - \"\u002Fapps\u002F*\"\n    - \"\u002Fpackages\u002F*\"\n    - \"\u002Fservices\u002F*\"\n  schedule:\n    interval: \"weekly\"\n```\n\n### Cross-Directory Grouping\n\nUse `group-by: dependency-name` to create a single PR when the same dependency updates across multiple directories:\n\n```yaml\ngroups:\n  monorepo-deps:\n    group-by: dependency-name\n```\n\nThis creates one PR per dependency across all specified directories, reducing CI costs and review burden.\n\nLimitations:\n- All directories must use the same package ecosystem\n- Applies to version updates only\n- Incompatible version constraints create separate PRs\n\n### Standalone Packages Outside Workspaces\n\nIf a directory has its own lockfile and is NOT part of the workspace (e.g., scripts in `.github\u002F`), create a separate ecosystem entry for it.\n\n## Dependency Grouping\n\nReduce PR noise by grouping related dependencies into single PRs.\n\n### By Dependency Type\n\n```yaml\ngroups:\n  dev-dependencies:\n    dependency-type: \"development\"\n    update-types: [\"minor\", \"patch\"]\n  production-dependencies:\n    dependency-type: \"production\"\n    update-types: [\"minor\", \"patch\"]\n```\n\n### By Name Pattern\n\n```yaml\ngroups:\n  angular:\n    patterns: [\"@angular*\"]\n    update-types: [\"minor\", \"patch\"]\n  testing:\n    patterns: [\"jest*\", \"@testing-library*\", \"ts-jest\"]\n```\n\n### For Security Updates\n\n```yaml\ngroups:\n  security-patches:\n    applies-to: security-updates\n    patterns: [\"*\"]\n    update-types: [\"patch\", \"minor\"]\n```\n\nKey behaviors:\n- Dependencies matching multiple groups go to the **first** match\n- `applies-to` defaults to `version-updates` when absent\n- Ungrouped dependencies get individual PRs\n\n## Multi-Ecosystem Groups\n\nCombine updates across different package ecosystems into a single PR:\n\n```yaml\nversion: 2\n\nmulti-ecosystem-groups:\n  infrastructure:\n    schedule:\n      interval: \"weekly\"\n    labels: [\"infrastructure\", \"dependencies\"]\n\nupdates:\n  - package-ecosystem: \"docker\"\n    directory: \"\u002F\"\n    patterns: [\"nginx\", \"redis\"]\n    multi-ecosystem-group: \"infrastructure\"\n\n  - package-ecosystem: \"terraform\"\n    directory: \"\u002F\"\n    patterns: [\"aws*\"]\n    multi-ecosystem-group: \"infrastructure\"\n```\n\nThe `patterns` key is required when using `multi-ecosystem-group`.\n\n## PR Customization\n\n### Labels\n\n```yaml\nlabels:\n  - \"dependencies\"\n  - \"npm\"\n```\n\nSet `labels: []` to disable all labels including defaults. SemVer labels (`major`, `minor`, `patch`) are always applied if present in the repo.\n\n### Commit Messages\n\n```yaml\ncommit-message:\n  prefix: \"deps\"\n  prefix-development: \"deps-dev\"\n  include: \"scope\"  # adds deps\u002Fdeps-dev scope after prefix\n```\n\n### Assignees and Milestones\n\n```yaml\nassignees: [\"security-team-lead\"]\nmilestone: 4  # numeric ID from milestone URL\n```\n\n### Branch Name Separator\n\n```yaml\npull-request-branch-name:\n  separator: \"-\"  # default is \u002F\n```\n\n### Target Branch\n\n```yaml\ntarget-branch: \"develop\"  # PRs target this instead of default branch\n```\n\nNote: When `target-branch` is set, security updates still target the default branch; all ecosystem config only applies to version updates.\n\n## Schedule Optimization\n\n### Intervals\n\nSupported: `daily`, `weekly`, `monthly`, `quarterly`, `semiannually`, `yearly`, `cron`\n\n```yaml\nschedule:\n  interval: \"weekly\"\n  day: \"monday\"         # for weekly only\n  time: \"09:00\"         # HH:MM format\n  timezone: \"America\u002FNew_York\"\n```\n\n### Cron Expressions\n\n```yaml\nschedule:\n  interval: \"cron\"\n  cronjob: \"0 9 * * 1\"  # Every Monday at 9 AM\n```\n\n### Cooldown Periods\n\nDelay updates for newly released versions to avoid early-adopter issues:\n\n```yaml\ncooldown:\n  default-days: 5\n  semver-major-days: 30\n  semver-minor-days: 7\n  semver-patch-days: 3\n  include: [\"*\"]\n  exclude: [\"critical-lib\"]\n```\n\nCooldown applies to version updates only, not security updates.\n\n## Security Updates Configuration\n\n### Enable via Repository Settings\n\nSettings → Advanced Security → Enable Dependabot alerts, security updates, and grouped security updates.\n\n### Group Security Updates in YAML\n\n```yaml\ngroups:\n  security-patches:\n    applies-to: security-updates\n    patterns: [\"*\"]\n    update-types: [\"patch\", \"minor\"]\n```\n\n### Disable Version Updates (Security Only)\n\n```yaml\nopen-pull-requests-limit: 0  # disables version update PRs\n```\n\n### Auto-Triage Rules\n\nGitHub presets auto-dismiss low-impact alerts for development dependencies. Custom rules can filter by severity, package name, CWE, and more. Configure in repository Settings → Advanced Security.\n\n## PR Comment Commands\n\nInteract with Dependabot PRs using `@dependabot` comments.\n\n> **Note:** As of January 2026, merge\u002Fclose\u002Freopen commands have been deprecated.\n> Use GitHub's native UI, CLI (`gh pr merge`), or auto-merge instead.\n\n| Command | Effect |\n|---|---|\n| `@dependabot rebase` | Rebase the PR |\n| `@dependabot recreate` | Recreate the PR from scratch |\n| `@dependabot ignore this dependency` | Close and never update this dependency |\n| `@dependabot ignore this major version` | Ignore this major version |\n| `@dependabot ignore this minor version` | Ignore this minor version |\n| `@dependabot ignore this patch version` | Ignore this patch version |\n\nFor grouped PRs, additional commands:\n- `@dependabot ignore DEPENDENCY_NAME` — ignore specific dependency in group\n- `@dependabot unignore DEPENDENCY_NAME` — clear ignores, reopen with updates\n- `@dependabot unignore *` — clear all ignores for all dependencies in group\n- `@dependabot show DEPENDENCY_NAME ignore conditions` — display current ignores\n\nFor the complete command reference, see `references\u002Fpr-commands.md`.\n\n## Ignore and Allow Rules\n\n### Ignore Specific Dependencies\n\n```yaml\nignore:\n  - dependency-name: \"lodash\"\n  - dependency-name: \"@types\u002Fnode\"\n    update-types: [\"version-update:semver-patch\"]\n  - dependency-name: \"express\"\n    versions: [\"5.x\"]\n```\n\n### Allow Only Specific Types\n\n```yaml\nallow:\n  - dependency-type: \"production\"\n  - dependency-name: \"express\"\n```\n\nRule: If a dependency matches both `allow` and `ignore`, it is **ignored**.\n\n### Exclude Paths\n\n```yaml\nexclude-paths:\n  - \"vendor\u002F**\"\n  - \"test\u002Ffixtures\u002F**\"\n```\n\n## Advanced Options\n\n### Versioning Strategy\n\nControls how Dependabot edits version constraints:\n\n| Value | Behavior |\n|---|---|\n| `auto` | Default — increase for apps, widen for libraries |\n| `increase` | Always increase minimum version |\n| `increase-if-necessary` | Only change if current range excludes new version |\n| `lockfile-only` | Only update lockfiles, ignore manifests |\n| `widen` | Widen range to include both old and new versions |\n\n### Rebase Strategy\n\n```yaml\nrebase-strategy: \"disabled\"  # stop auto-rebasing\n```\n\nDependabot stops rebasing a PR once anyone else pushes a commit to its branch. A `[dependabot skip]` in that commit's message lifts that stop (it does not override `rebase-strategy: \"disabled\"`): the next rebase force-pushes over the branch, which discards the commit. Leave the marker out to keep your commit.\n\n### Open PR Limit\n\n```yaml\nopen-pull-requests-limit: 10  # default is 5 for version, 10 for security\n```\n\nSet to `0` to disable version updates entirely.\n\n### Private Registries\n\n```yaml\nregistries:\n  npm-private:\n    type: npm-registry\n    url: https:\u002F\u002Fnpm.example.com\n    token: ${{secrets.NPM_TOKEN}}\n\nupdates:\n  - package-ecosystem: \"npm\"\n    directory: \"\u002F\"\n    registries:\n      - npm-private\n```\n\n## FAQ\n\n**Can I have multiple `dependabot.yml` files?**\nNo. GitHub supports exactly one file at `.github\u002Fdependabot.yml`. Use multiple `updates` entries within that file for different ecosystems and directories.\n\n**Does Dependabot support pnpm?**\nYes. Use `package-ecosystem: \"npm\"` — Dependabot detects `pnpm-lock.yaml` automatically.\n\n**How do I reduce PR noise in a monorepo?**\nUse `groups` to batch updates, `directories` with globs for coverage, and `group-by: dependency-name` for cross-directory grouping. Consider `monthly` or `quarterly` intervals for low-priority ecosystems.\n\n**How do I handle dependencies outside the workspace?**\nCreate a separate ecosystem entry with its own `directory` pointing to that location.\n\n## Pre-Commit Dependency Scanning via AI Coding Agents\n\nFor scanning code changes for vulnerable dependencies inside an AI coding agent before committing, the GitHub MCP Server's `dependabot` toolset can check your dependency additions against the GitHub Advisory Database and return structured results with affected packages, severity, and recommended fixed versions. For more thorough post-commit checks, it can also run the Dependabot CLI locally to diff dependency graphs before and after your changes.\n\nInstall the **Advanced Security plugin** which provides dedicated dependency scanning tools and the `\u002Fdependency-scanning` skill.\n\n**GitHub Copilot CLI (shell):**\n```bash\n# Enable the dependabot toolset for the GitHub MCP Server\ncopilot --add-github-mcp-toolset dependabot\n```\n\n**GitHub Copilot CLI (inside `copilot`):**\n```text\n> \u002Fplugin install advanced-security@copilot-plugins\n```\n\n**Visual Studio Code:**\n- Add `\"X-MCP-Toolsets\": \"dependabot\"` to your GitHub MCP Server headers, or pick **Dependabot** from the toolset selector in Copilot Chat\n- Install the `advanced-security` plugin, then use `\u002Fdependency-scanning` in Copilot Chat\n\n**Example prompt:**\n> Scan the dependencies I added on this branch for known vulnerabilities and tell me which versions to upgrade to before I commit.\n\nSee: [Advanced Security Plugin — Dependency Scanning Skill](https:\u002F\u002Fgithub.com\u002Fgithub\u002Fcopilot-plugins\u002Fblob\u002Fmain\u002Fplugins\u002Fadvanced-security\u002Fskills\u002Fdependency-scanning\u002FSKILL.md)\n\n> Announced in [Dependency scanning with GitHub MCP Server is in public preview](https:\u002F\u002Fgithub.blog\u002Fchangelog\u002F2026-05-05-dependency-scanning-with-github-mcp-server-is-in-public-preview\u002F) (May 2026)\n\n## Resources\n\n- `references\u002Fdependabot-yml-reference.md` — Complete YAML options reference\n- `references\u002Fpr-commands.md` — Full PR comment commands reference\n- `references\u002Fexample-configs.md` — Real-world configuration examples\n","# Dependabot Configuration & Management\n\n## Overview\n\nDependabot is GitHub's built-in dependency management tool with three core capabilities:\n\n1. **Dependabot Alerts** — Notify when dependencies have known vulnerabilities (CVEs)\n2. **Dependabot Security Updates** — Auto-create PRs to fix vulnerable dependencies\n3. **Dependabot Version Updates** — Auto-create PRs to keep dependencies current\n\nAll configuration lives in a **single file**: `.github\u002Fdependabot.yml` on the default branch. GitHub does **not** support multiple `dependabot.yml` files per repository.\n\n## Configuration Workflow\n\nFollow this process when creating or optimizing a `dependabot.yml`:\n\n### Step 1: Detect All Ecosystems\n\nScan the repository for dependency manifests. Look for:\n\n| Ecosystem | YAML Value | Manifest Files |\n|---|---|---|\n| npm\u002Fpnpm\u002Fyarn | `npm` | `package.json`, `package-lock.json`, `pnpm-lock.yaml`, `yarn.lock` |\n| pip\u002Fpipenv\u002Fpoetry | `pip` | `requirements.txt`, `Pipfile`, `pyproject.toml`, `setup.py` |\n| uv | `uv` | `pyproject.toml`, `uv.lock` |\n| Docker | `docker` | `Dockerfile` |\n| Docker Compose | `docker-compose` | `docker-compose.yml` |\n| GitHub Actions | `github-actions` | `.github\u002Fworkflows\u002F*.yml` |\n| Go modules | `gomod` | `go.mod` |\n| Bundler (Ruby) | `bundler` | `Gemfile` |\n| Cargo (Rust) | `cargo` | `Cargo.toml` |\n| Composer (PHP) | `composer` | `composer.json` |\n| NuGet (.NET) | `nuget` | `*.csproj`, `packages.config` |\n| .NET SDK | `dotnet-sdk` | `global.json` |\n| Maven (Java) | `maven` | `pom.xml` |\n| Gradle (Java) | `gradle` | `build.gradle` |\n| Terraform | `terraform` | `*.tf` |\n| OpenTofu | `opentofu` | `*.tf` |\n| Helm | `helm` | `Chart.yaml` |\n| Hex (Elixir) | `mix` | `mix.exs` |\n| Swift | `swift` | `Package.swift` |\n| Pub (Dart) | `pub` | `pubspec.yaml` |\n| Bun | `bun` | `bun.lockb` |\n| Dev Containers | `devcontainers` | `devcontainer.json` |\n| Git Submodules | `gitsubmodule` | `.gitmodules` |\n| Pre-commit | `pre-commit` | `.pre-commit-config.yaml` |\n\nNotes:\n- pnpm and yarn both use the `npm` ecosystem value.\n- Prefer `uv` ecosystem value when `uv.lock` is present; otherwise use `pip`.\n\n### Step 2: Map Directory Locations\n\nFor each ecosystem, identify where manifests live. Use `directories` (plural) with glob patterns for monorepos:\n\n```yaml\ndirectories:\n  - \"\u002F\"           # root\n  - \"\u002Fapps\u002F*\"     # all app subdirs\n  - \"\u002Fpackages\u002F*\" # all package subdirs\n  - \"\u002Flib-*\"      # dirs starting with lib-\n  - \"**\u002F*\"        # recursive (all subdirs)\n```\n\nImportant: `directory` (singular) does NOT support globs. Use `directories` (plural) for wildcards.\n\n### Step 3: Configure Each Ecosystem Entry\n\nEvery entry needs at minimum:\n\n```yaml\n- package-ecosystem: \"npm\"\n  directory: \"\u002F\"\n  schedule:\n    interval: \"weekly\"\n```\n\n### Step 4: Optimize with Grouping, Labels, and Scheduling\n\nSee sections below for each optimization technique.\n\n## Monorepo Strategies\n\n### Glob Patterns for Workspace Coverage\n\nFor monorepos with many packages, use glob patterns to avoid listing each directory:\n\n```yaml\n- package-ecosystem: \"npm\"\n  directories:\n    - \"\u002F\"\n    - \"\u002Fapps\u002F*\"\n    - \"\u002Fpackages\u002F*\"\n    - \"\u002Fservices\u002F*\"\n  schedule:\n    interval: \"weekly\"\n```\n\n### Cross-Directory Grouping\n\nUse `group-by: dependency-name` to create a single PR when the same dependency updates across multiple directories:\n\n```yaml\ngroups:\n  monorepo-deps:\n    group-by: dependency-name\n```\n\nThis creates one PR per dependency across all specified directories, reducing CI costs and review burden.\n\nLimitations:\n- All directories must use the same package ecosystem\n- Applies to version updates only\n- Incompatible version constraints create separate PRs\n\n### Standalone Packages Outside Workspaces\n\nIf a directory has its own lockfile and is NOT part of the workspace (e.g., scripts in `.github\u002F`), create a separate ecosystem entry for it.\n\n## Dependency Grouping\n\nReduce PR noise by grouping related dependencies into single PRs.\n\n### By Dependency Type\n\n```yaml\ngroups:\n  dev-dependencies:\n    dependency-type: \"development\"\n    update-types: [\"minor\", \"patch\"]\n  production-dependencies:\n    dependency-type: \"production\"\n    update-types: [\"minor\", \"patch\"]\n```\n\n### By Name Pattern\n\n```yaml\ngroups:\n  angular:\n    patterns: [\"@angular*\"]\n    update-types: [\"minor\", \"patch\"]\n  testing:\n    patterns: [\"jest*\", \"@testing-library*\", \"ts-jest\"]\n```\n\n### For Security Updates\n\n```yaml\ngroups:\n  security-patches:\n    applies-to: security-updates\n    patterns: [\"*\"]\n    update-types: [\"patch\", \"minor\"]\n```\n\nKey behaviors:\n- Dependencies matching multiple groups go to the **first** match\n- `applies-to` defaults to `version-updates` when absent\n- Ungrouped dependencies get individual PRs\n\n## Multi-Ecosystem Groups\n\nCombine updates across different package ecosystems into a single PR:\n\n```yaml\nversion: 2\n\nmulti-ecosystem-groups:\n  infrastructure:\n    schedule:\n      interval: \"weekly\"\n    labels: [\"infrastructure\", \"dependencies\"]\n\nupdates:\n  - package-ecosystem: \"docker\"\n    directory: \"\u002F\"\n    patterns: [\"nginx\", \"redis\"]\n    multi-ecosystem-group: \"infrastructure\"\n\n  - package-ecosystem: \"terraform\"\n    directory: \"\u002F\"\n    patterns: [\"aws*\"]\n    multi-ecosystem-group: \"infrastructure\"\n```\n\nThe `patterns` key is required when using `multi-ecosystem-group`.\n\n## PR Customization\n\n### Labels\n\n```yaml\nlabels:\n  - \"dependencies\"\n  - \"npm\"\n```\n\nSet `labels: []` to disable all labels including defaults. SemVer labels (`major`, `minor`, `patch`) are always applied if present in the repo.\n\n### Commit Messages\n\n```yaml\ncommit-message:\n  prefix: \"deps\"\n  prefix-development: \"deps-dev\"\n  include: \"scope\"  # adds deps\u002Fdeps-dev scope after prefix\n```\n\n### Assignees and Milestones\n\n```yaml\nassignees: [\"security-team-lead\"]\nmilestone: 4  # numeric ID from milestone URL\n```\n\n### Branch Name Separator\n\n```yaml\npull-request-branch-name:\n  separator: \"-\"  # default is \u002F\n```\n\n### Target Branch\n\n```yaml\ntarget-branch: \"develop\"  # PRs target this instead of default branch\n```\n\nNote: When `target-branch` is set, security updates still target the default branch; all ecosystem config only applies to version updates.\n\n## Schedule Optimization\n\n### Intervals\n\nSupported: `daily`, `weekly`, `monthly`, `quarterly`, `semiannually`, `yearly`, `cron`\n\n```yaml\nschedule:\n  interval: \"weekly\"\n  day: \"monday\"         # for weekly only\n  time: \"09:00\"         # HH:MM format\n  timezone: \"America\u002FNew_York\"\n```\n\n### Cron Expressions\n\n```yaml\nschedule:\n  interval: \"cron\"\n  cronjob: \"0 9 * * 1\"  # Every Monday at 9 AM\n```\n\n### Cooldown Periods\n\nDelay updates for newly released versions to avoid early-adopter issues:\n\n```yaml\ncooldown:\n  default-days: 5\n  semver-major-days: 30\n  semver-minor-days: 7\n  semver-patch-days: 3\n  include: [\"*\"]\n  exclude: [\"critical-lib\"]\n```\n\nCooldown applies to version updates only, not security updates.\n\n## Security Updates Configuration\n\n### Enable via Repository Settings\n\nSettings → Advanced Security → Enable Dependabot alerts, security updates, and grouped security updates.\n\n### Group Security Updates in YAML\n\n```yaml\ngroups:\n  security-patches:\n    applies-to: security-updates\n    patterns: [\"*\"]\n    update-types: [\"patch\", \"minor\"]\n```\n\n### Disable Version Updates (Security Only)\n\n```yaml\nopen-pull-requests-limit: 0  # disables version update PRs\n```\n\n### Auto-Triage Rules\n\nGitHub presets auto-dismiss low-impact alerts for development dependencies. Custom rules can filter by severity, package name, CWE, and more. Configure in repository Settings → Advanced Security.\n\n## PR Comment Commands\n\nInteract with Dependabot PRs using `@dependabot` comments.\n\n> **Note:** As of January 2026, merge\u002Fclose\u002Freopen commands have been deprecated.\n> Use GitHub's native UI, CLI (`gh pr merge`), or auto-merge instead.\n\n| Command | Effect |\n|---|---|\n| `@dependabot rebase` | Rebase the PR |\n| `@dependabot recreate` | Recreate the PR from scratch |\n| `@dependabot ignore this dependency` | Close and never update this dependency |\n| `@dependabot ignore this major version` | Ignore this major version |\n| `@dependabot ignore this minor version` | Ignore this minor version |\n| `@dependabot ignore this patch version` | Ignore this patch version |\n\nFor grouped PRs, additional commands:\n- `@dependabot ignore DEPENDENCY_NAME` — ignore specific dependency in group\n- `@dependabot unignore DEPENDENCY_NAME` — clear ignores, reopen with updates\n- `@dependabot unignore *` — clear all ignores for all dependencies in group\n- `@dependabot show DEPENDENCY_NAME ignore conditions` — display current ignores\n\nFor the complete command reference, see `references\u002Fpr-commands.md`.\n\n## Ignore and Allow Rules\n\n### Ignore Specific Dependencies\n\n```yaml\nignore:\n  - dependency-name: \"lodash\"\n  - dependency-name: \"@types\u002Fnode\"\n    update-types: [\"version-update:semver-patch\"]\n  - dependency-name: \"express\"\n    versions: [\"5.x\"]\n```\n\n### Allow Only Specific Types\n\n```yaml\nallow:\n  - dependency-type: \"production\"\n  - dependency-name: \"express\"\n```\n\nRule: If a dependency matches both `allow` and `ignore`, it is **ignored**.\n\n### Exclude Paths\n\n```yaml\nexclude-paths:\n  - \"vendor\u002F**\"\n  - \"test\u002Ffixtures\u002F**\"\n```\n\n## Advanced Options\n\n### Versioning Strategy\n\nControls how Dependabot edits version constraints:\n\n| Value | Behavior |\n|---|---|\n| `auto` | Default — increase for apps, widen for libraries |\n| `increase` | Always increase minimum version |\n| `increase-if-necessary` | Only change if current range excludes new version |\n| `lockfile-only` | Only update lockfiles, ignore manifests |\n| `widen` | Widen range to include both old and new versions |\n\n### Rebase Strategy\n\n```yaml\nrebase-strategy: \"disabled\"  # stop auto-rebasing\n```\n\nDependabot stops rebasing a PR once anyone else pushes a commit to its branch. A `[dependabot skip]` in that commit's message lifts that stop (it does not override `rebase-strategy: \"disabled\"`): the next rebase force-pushes over the branch, which discards the commit. Leave the marker out to keep your commit.\n\n### Open PR Limit\n\n```yaml\nopen-pull-requests-limit: 10  # default is 5 for version, 10 for security\n```\n\nSet to `0` to disable version updates entirely.\n\n### Private Registries\n\n```yaml\nregistries:\n  npm-private:\n    type: npm-registry\n    url: https:\u002F\u002Fnpm.example.com\n    token: ${{secrets.NPM_TOKEN}}\n\nupdates:\n  - package-ecosystem: \"npm\"\n    directory: \"\u002F\"\n    registries:\n      - npm-private\n```\n\n## FAQ\n\n**Can I have multiple `dependabot.yml` files?**\nNo. GitHub supports exactly one file at `.github\u002Fdependabot.yml`. Use multiple `updates` entries within that file for different ecosystems and directories.\n\n**Does Dependabot support pnpm?**\nYes. Use `package-ecosystem: \"npm\"` — Dependabot detects `pnpm-lock.yaml` automatically.\n\n**How do I reduce PR noise in a monorepo?**\nUse `groups` to batch updates, `directories` with globs for coverage, and `group-by: dependency-name` for cross-directory grouping. Consider `monthly` or `quarterly` intervals for low-priority ecosystems.\n\n**How do I handle dependencies outside the workspace?**\nCreate a separate ecosystem entry with its own `directory` pointing to that location.\n\n## Pre-Commit Dependency Scanning via AI Coding Agents\n\nFor scanning code changes for vulnerable dependencies inside an AI coding agent before committing, the GitHub MCP Server's `dependabot` toolset can check your dependency additions against the GitHub Advisory Database and return structured results with affected packages, severity, and recommended fixed versions. For more thorough post-commit checks, it can also run the Dependabot CLI locally to diff dependency graphs before and after your changes.\n\nInstall the **Advanced Security plugin** which provides dedicated dependency scanning tools and the `\u002Fdependency-scanning` skill.\n\n**GitHub Copilot CLI (shell):**\n```bash\n# Enable the dependabot toolset for the GitHub MCP Server\ncopilot --add-github-mcp-toolset dependabot\n```\n\n**GitHub Copilot CLI (inside `copilot`):**\n```text\n> \u002Fplugin install advanced-security@copilot-plugins\n```\n\n**Visual Studio Code:**\n- Add `\"X-MCP-Toolsets\": \"dependabot\"` to your GitHub MCP Server headers, or pick **Dependabot** from the toolset selector in Copilot Chat\n- Install the `advanced-security` plugin, then use `\u002Fdependency-scanning` in Copilot Chat\n\n**Example prompt:**\n> Scan the dependencies I added on this branch for known vulnerabilities and tell me which versions to upgrade to before I commit.\n\nSee: [Advanced Security Plugin — Dependency Scanning Skill](https:\u002F\u002Fgithub.com\u002Fgithub\u002Fcopilot-plugins\u002Fblob\u002Fmain\u002Fplugins\u002Fadvanced-security\u002Fskills\u002Fdependency-scanning\u002FSKILL.md)\n\n> Announced in [Dependency scanning with GitHub MCP Server is in public preview](https:\u002F\u002Fgithub.blog\u002Fchangelog\u002F2026-05-05-dependency-scanning-with-github-mcp-server-is-in-public-preview\u002F) (May 2026)\n\n## Resources\n\n- `references\u002Fdependabot-yml-reference.md` — Complete YAML options reference\n- `references\u002Fpr-commands.md` — Full PR comment commands reference\n- `references\u002Fexample-configs.md` — Real-world configuration examples\n",{"name":5,"description":7},"main","96543145e9cb97711020b57b9d88f968062c4fc7","skills\u002Fdependabot",5344,"https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot","https:\u002F\u002Fawesome-copilot.github.com\u002F","https:\u002F\u002Fgithub.com\u002Fgithub","https:\u002F\u002Fgithub.com\u002Fabout","How people build software.","2026-11-13 02:05:36",{"source":8,"skillName":5,"commands":60,"prompt":70,"zipAvailable":71},[61,64,67],{"tool":62,"command":63},"npx","npx skills add github\u002Fawesome-copilot --skill dependabot",{"tool":65,"command":66},"bunx","bunx skills add github\u002Fawesome-copilot --skill dependabot",{"tool":68,"command":69},"pnpm","pnpm dlx skills add github\u002Fawesome-copilot --skill dependabot","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fdependabot\u002FSKILL.md",true,[73,79,83],{"path":74,"resourceType":75,"resourceTypeDesc":76,"sizeBytes":77,"sourceHtmlUrl":78},"references\u002Fdependabot-yml-reference.md","REFERENCE","参考文档",9727,"https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fdependabot\u002Freferences\u002Fdependabot-yml-reference.md",{"path":80,"resourceType":75,"resourceTypeDesc":76,"sizeBytes":81,"sourceHtmlUrl":82},"references\u002Fexample-configs.md",8186,"https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fdependabot\u002Freferences\u002Fexample-configs.md",{"path":84,"resourceType":75,"resourceTypeDesc":76,"sizeBytes":85,"sourceHtmlUrl":86},"references\u002Fpr-commands.md",4399,"https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fdependabot\u002Freferences\u002Fpr-commands.md",[88,116,143,173,207,224],{"skillNo":89,"name":90,"nameZh":6,"description":91,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":92,"categories":93,"keywords":98,"publishedAt":44},"01M70KXZNX9ES38N2A8M58ZZMZ","supabase-rls-policies","Write, review, and test Supabase Row Level Security (RLS) policies so that one user cannot read or change another user's rows. Use when creating or changing tables, policies, views, or security definer functions in a Supabase project, when reviewing a migration that touches RLS, or when asked to prove user isolation with pgTAP tests that sign in as two users.","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fsupabase-rls-policies\u002FSKILL.md",[94,97],{"categoryNo":95,"categoryName":96,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[99,100,101,102,103,104,105,106,107,108,35,109,110,111,112,113,30,27,114,115],"supabase","rls","supabase rls","supabase rls policies","project","when","review","change","read","write","isolation","tables","as","tests","prove","functions","with",{"skillNo":117,"name":118,"nameZh":6,"description":119,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":120,"categories":121,"keywords":123,"publishedAt":44},"01M70KWA5YWXDV6V8DZ19E3T2Y","skill-distribution-audit","Audit a skill collection before release or investigate installer omissions, archived\u002Ftemplate leakage, duplicate identities, and manifest drift. Reconcile the intended public source set, distribution manifest, and actual discovery output for a specified consumer version. Includes a deterministic set-comparison helper.","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fskill-distribution-audit\u002FSKILL.md",[122],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[124,125,126,127,128,129,32,130,131,132,133,134,135,136,137,138,139,140,141,142],"distribution","skill distribution audit","audit","SET","deterministic","installer","discovery","comparison","helper","manifest","version","collection","drift","output","investigate","duplicate","template","release","reconcile",{"skillNo":144,"name":145,"nameZh":6,"description":146,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":147,"sourceHtmlUrl":148,"categories":149,"keywords":155,"publishedAt":44},"01M70KCJPFVW7PPQ49CC5R8JGK","logicapps-custom-code-net10-migration","Migrate Azure Logic Apps Standard local-function custom-code projects from .NET 8 to .NET 10. Use for legacy Logic Apps custom-code workspace upgrades, project\u002Fpackage configuration, custom-worker settings, publication, and integrated VS Code debugging. Not for ordinary .NET applications, standalone Azure Functions, Consumption workflows, or cloud deployment.","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Flogicapps-custom-code-net10-migration\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Flogicapps-custom-code-net10-migration\u002FSKILL.md",[150],{"categoryNo":151,"categoryName":152,"taxonomyType":153,"taxonomyTypeDesc":154},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[156,157,158,159,160,161,32,103,162,163,164,165,166,167,168,30,169,170,171,172],"custom","code","logicapps custom code net10 migration","migration","projects","standalone","deployment","applications","local","azure","worker","upgrades","package","apps","Legacy","debugging","workflows",{"skillNo":174,"name":175,"nameZh":6,"description":176,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":177,"sourceHtmlUrl":178,"categories":179,"keywords":184,"publishedAt":44},"01M6AEBN37RQMXJ3298PEY7PG1","winmd-api-search","Find and explore Windows desktop APIs. Use when building features that need platform capabilities — camera, file access, notifications, UI controls, AI\u002FML, sensors, networking, etc. Discovers the right API for a task and retrieves full type details (methods, properties, events, enumeration values).","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fwinmd-api-search\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fwinmd-api-search\u002FSKILL.md",[180,183],{"categoryNo":181,"categoryName":182,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":151,"categoryName":152,"taxonomyType":153,"taxonomyTypeDesc":154},[185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,104,200,201,202,203,204,32,205,206],"winmd api search","search","api","windows","desktop","file access","enumeration","ui","ml","file","networking","capabilities","notifications","explore","access","features","full","camera","events","platform","methods","controls",{"skillNo":208,"name":209,"nameZh":6,"description":210,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":211,"licenseFileUrl":212,"sourceHtmlUrl":213,"categories":214,"keywords":220,"publishedAt":44},"01M6AE571R3SC1ZGE202B3NB5S","resemble-detect","Deepfake detection and media safety — detect AI-generated audio, images, video, and text, trace synthesis sources, apply watermarks, verify speaker identity, and analyze media intelligence using Resemble AI","Apache-2.0","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fresemble-detect\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fresemble-detect\u002FSKILL.md",[215,216,219],{"categoryNo":181,"categoryName":182,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":217,"categoryName":218,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000016","图像与多媒体",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[221,127,194,222,223],"resemble detect","https","identity",{"skillNo":225,"name":226,"nameZh":6,"description":227,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":211,"licenseFileUrl":228,"sourceHtmlUrl":229,"categories":230,"keywords":235,"publishedAt":44},"01M6AE30BSK2HCY4TQQ22Z8JRD","quality-playbook","Run a complete quality engineering audit on any codebase. Derives behavioral requirements from the code, generates spec-traced functional tests, runs a three-pass code review with regression tests, executes a multi-model spec audit (Council of Three), and produces a consolidated bug report with TDD-verified patches. Finds the 35% of real defects that structural code review alone cannot catch. Works with any language. Trigger on 'quality playbook', 'spec audit', 'Council of Three', 'fitness-to-purpose', or 'coverage theater'.","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fquality-playbook\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fquality-playbook\u002FSKILL.md",[231,234],{"categoryNo":232,"categoryName":233,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000007","代码审查",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[236,237,238,239,157,105,9,126,240,241,222,242,243,244,245,246,247,248,249,250,251,252,112,253,254,255,256],"playbook","quality playbook","quality","code review","tdd","run","report","spec","bug report","council","engineering","functional","spec audit","bug","verified","multi-model","three","coverage","model","regression","structural"]