Tame Dependabot: Group your updates, slow the cadence, keep security fast

The issue faced by Microsoft’s GCToolkit repository was that its Dependabot pull requests were too frequent, with 92 out of 578 commits being routine maintenance updates. This led to a large number of review, merge, and CI cycles, making it difficult to keep up with security updates. The configuration used before had a daily interval and limited the number of open pull requests to 10, causing multiple pull requests to be created for each dependency bump.

The solution was to group the updates into a single pull request and slow the cadence from daily to monthly. This was achieved by changing the configuration to use the "monthly" interval and introducing a new "groups" section. The "groups" section allowed for the creation of a "monthly-batch" group that included all dependencies, which then appeared in a single pull request titled "Bump the monthly-batch group with 10 updates."

This approach reduced the number of pull requests, CI runs, and review notifications, making it easier to manage and review updates.

For larger projects, it is possible to define multiple named groups with more specific patterns, keeping related updates together and unrelated ones separate. This way, the project can benefit from the grouping feature even further. Dependabot also gained the ability to group updates for the same dependency across multiple directories into a single pull request, which was particularly useful for monorepos.

By specifying a list of directories or a glob, Dependabot could collapse all updates into one pull request, as shown in the example with the "npm" package-ecosystem.