You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Multi-ecosystem updates allow you to create groups that span multiple package ecosystems and get a single {% data variables.product.prodname_dependabot %} pull request with updates across all supported ecosystems. This approach helps reduce the number of {% data variables.product.prodname_dependabot %} pull requests you receive and streamlines your dependency update workflow.
22
+
Multi-ecosystem updates allow you to create groups that span multiple package ecosystems and get a single {% data variables.product.prodname_dependabot %} pull request with updates across all supported ecosystems. This approach helps reduce the number of {% data variables.product.prodname_dependabot %} pull requests you receive and streamlines your dependency update workflow.
22
23
23
24
Multi-ecosystem updates are particularly useful for:
24
25
@@ -28,9 +29,9 @@ Multi-ecosystem updates are particularly useful for:
28
29
29
30
## Getting Started
30
31
31
-
You should follow these instructions to set up your first multi-ecosystem group.
32
+
You should follow these instructions to set up your first multi-ecosystem group.
32
33
33
-
### 1. Add `multi-ecosystem-groups` to your `.github/dependabot.yml` file
34
+
### 1. Add `multi-ecosystem-groups` to your `.github/dependabot.yml` file
34
35
35
36
Start by defining a group with a schedule in the top-level `multi-ecosystem-groups` section:
36
37
@@ -46,7 +47,7 @@ updates:
46
47
# Your existing package ecosystems will go here
47
48
```
48
49
49
-
### 2. Assign ecosystems to groups with patterns
50
+
### 2. Assign ecosystems to groups with patterns
50
51
51
52
1. Add the `multi-ecosystem-group` key.
52
53
1. Add `patterns` to your package ecosystem configurations.
@@ -64,26 +65,26 @@ updates:
64
65
directory: "/"
65
66
patterns: ["nginx", "redis", "postgres"]
66
67
multi-ecosystem-group: "infrastructure"
67
-
68
+
68
69
- package-ecosystem: "terraform"
69
70
directory: "/"
70
71
patterns: ["aws", "terraform-*"]
71
72
multi-ecosystem-group: "infrastructure"
72
73
```
73
74
74
75
> [!IMPORTANT]
75
-
> The `patterns` key is required when using `multi-ecosystem-group`. You can specify dependency patterns to include only certain dependencies in the group, or use `["*"]` to include all dependencies.
76
+
> The `patterns` key is required when using `multi-ecosystem-group`. You can specify dependency patterns to include only certain dependencies in the group, or use `["*"]` to include all dependencies.
76
77
77
-
### 3. Commit and watch for consolidated pull requests
78
+
### 3. Commit and watch for consolidated pull requests
78
79
79
-
Once you commit the changes to your `dependabot.yml` file, {% data variables.product.prodname_dependabot %} will:
80
+
Once you commit the changes to your `dependabot.yml` file, {% data variables.product.prodname_dependabot %} will:
80
81
81
82
* Check for updates according to the group's schedule
82
83
* Check for updates according to the group's schedule.
83
84
* Create a single pull request containing updates for all the ecosystems specified in the group.
84
85
* Use the group identifier in the branch name and the pull request title.
85
86
86
-
### 4. Customize with additional keys (optional)
87
+
### 4. Customize with additional keys (optional)
87
88
88
89
Add [`assignees`](/code-security/dependabot/working-with-dependabot/dependabot-options-reference#assignees--), [`labels`](/code-security/dependabot/working-with-dependabot/dependabot-options-reference#labels--), and other settings to your groups:
89
90
@@ -100,7 +101,7 @@ updates:
100
101
directory: "/"
101
102
patterns: ["nginx", "redis", "postgres"]
102
103
multi-ecosystem-group: "infrastructure"
103
-
104
+
104
105
- package-ecosystem: "terraform"
105
106
directory: "/"
106
107
patterns: ["aws", "terraform-*"]
@@ -111,8 +112,8 @@ updates:
111
112
112
113
Multi-ecosystem updates use a two-level configuration structure to provide flexibility and control over how updates are grouped and managed:
113
114
114
-
* **Group-level** (`multi-ecosystem-groups`): This is where you define the overall group behavior, scheduling, and shared settings that apply to all package ecosystems in the group.
115
-
* **Ecosystem-level** (`updates`): Configure individual package managers within the group, including which dependencies to include and ecosystem-specific settings.
115
+
* **Group-level** (`multi-ecosystem-groups`): This is where you define the overall group behavior, scheduling, and shared settings that apply to all package ecosystems in the group.
116
+
* **Ecosystem-level** (`updates`): Configure individual package managers within the group, including which dependencies to include and ecosystem-specific settings.
116
117
117
118
This structure allows you to set consistent policies at the group level while maintaining fine-grained control over individual package ecosystems.
118
119
@@ -151,7 +152,7 @@ The following table shows the configuration keys available at the group level, a
151
152
| [`commit-message`](/code-security/dependabot/working-with-dependabot/dependabot-options-reference#commit-message--) |{% octicon "x" aria-label="Not required" %} |Group-only |
152
153
| [`pull-request-branch-name`](/code-security/dependabot/working-with-dependabot/dependabot-options-reference#pull-request-branch-nameseparator--) |{% octicon "x" aria-label="Not required" %} |Group-only |
153
154
154
-
### Ecosystem-level (`updates`)
155
+
### Ecosystem-level (`updates`)
155
156
156
157
The following table shows the configuration keys available at the ecosystem level, along with their behavior types. For more information, see [Configuration behavior](#configuration-behavior).
157
158
@@ -262,9 +263,9 @@ updates:
262
263
multi-ecosystem-group: "infrastructure"
263
264
```
264
265
265
-
**Result**: One weekly pull request containing updates for Docker images, Terraform providers, and Python dependencies used in infrastructure automation.
266
+
**Result**: One weekly pull request containing updates for Docker images, Terraform providers, and Python dependencies used in infrastructure automation.
266
267
267
-
### Full-stack applications
268
+
### Full-stack applications
268
269
269
270
**Scenario**: You have a web application with a React frontend and Rails backend. You want frontend and backend dependencies updated together to ensure compatibility and streamline testing.
270
271
@@ -289,7 +290,7 @@ updates:
289
290
290
291
**Result**: Daily PRs containing both frontend JavaScript/TypeScript updates and backend Ruby gem updates, allowing you to test the complete application together.
291
292
292
-
### Cross-platform libraries
293
+
### Cross-platform libraries
293
294
294
295
**Scenario**: You're building a library or service that uses the same protocols across different languages (like gRPC and Protocol Buffers). You want to keep the library versions synchronized across all implementations.
295
296
@@ -331,7 +332,7 @@ multi-ecosystem-groups:
331
332
commit-message:
332
333
prefix: "infra"
333
334
include: "scope"
334
-
335
+
335
336
# Application code updates - daily, with development team
336
337
full-stack:
337
338
schedule:
@@ -347,20 +348,20 @@ updates:
347
348
assignees: ["@docker-admin"] # adds to @platform-team (additive)
348
349
labels: ["docker"] # adds to infrastructure, dependencies (additive)
349
350
multi-ecosystem-group: "infrastructure"
350
-
351
+
351
352
# Terraform - infrastructure group with terraform specialists
352
353
- package-ecosystem: "terraform"
353
354
directory: "/"
354
355
patterns: ["aws", "terraform-*"]
355
356
multi-ecosystem-group: "infrastructure"
356
-
357
+
357
358
# Frontend - full-stack group with frontend focus
358
359
- package-ecosystem: "npm"
359
360
directory: "/frontend"
360
361
patterns: ["react", "lodash", "@types/*"]
361
362
labels: ["frontend"] # adds to full-stack (additive)
362
363
multi-ecosystem-group: "full-stack"
363
-
364
+
364
365
# Backend - full-stack group with backend specialist
365
366
- package-ecosystem: "bundler"
366
367
directory: "/backend"
@@ -394,11 +395,11 @@ updates:
394
395
395
396
This approach ensures that the right people are involved for each type of update while maintaining consistent policies across related technologies.
396
397
397
-
## Best practices
398
+
## Best practices
398
399
399
-
* **Group related dependencies**: Only group ecosystems that logically belong together.
400
-
* **Use descriptive identifiers**: Choose group names that clearly indicate the group's purpose.
400
+
* **Group related dependencies**: Only group ecosystems that logically belong together.
401
+
* **Use descriptive identifiers**: Choose group names that clearly indicate the group's purpose.
Copy file name to clipboardExpand all lines: content/code-security/securing-your-organization/understanding-your-organizations-exposure-to-vulnerabilities/about-your-exposure-to-vulnerable-dependencies.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -65,8 +65,8 @@ Focus on vulnerabilities that present the highest risk to your organization.
65
65
66
66
* Prioritize alerts with high or critical severity. For {% data variables.product.prodname_dependabot_alerts %}, also prioritize high EPSS scores, and available patches.
67
67
* Use the repository breakdown information to direct remediation efforts to the most at-risk projects.{% ifversion fpt or ghec %}
68
-
* Encourage development teams to address vulnerabilities that are actually used in deployed artifacts through repository custom properties and using production context. See [AUTOTITLE](/code-security/securing-your-organization/understanding-your-organizations-exposure-to-vulnerabilities/alerts-in-production-code).{% endif %}
69
-
* Create security campaigns to encourage and track the remediation of high priority {% data variables.product.prodname_code_scanning %} alerts. See [AUTOTITLE](/code-security/securing-your-organization/fixing-security-alerts-at-scale/creating-managing-security-campaigns).
68
+
* Encourage development teams to address vulnerabilities that are actually used in deployed artifacts through repository custom properties and using production context. See [AUTOTITLE](/code-security/securing-your-organization/understanding-your-organizations-exposure-to-vulnerabilities/alerts-in-production-code).{% endif %}{% ifversion security-campaigns %}
69
+
* Create security campaigns to encourage and track the remediation of high priority {% data variables.product.prodname_code_scanning %} alerts. See [AUTOTITLE](/code-security/securing-your-organization/fixing-security-alerts-at-scale/creating-managing-security-campaigns).{% endif %}
0 commit comments