Dependency Update Policy and Dependabot Plan
Plan how your team handles dependency updates, grouping, review rules, security alerts and a Dependabot configuration draft.
The Open buttons send the prompt text as currently shown below to that site only when you click. Fill in the placeholders first.
[VERIFY] is an editorial flag, not a blank to fill. Wherever the prompt shows [VERIFY], check that item against a reliable source before you use it.
Help me create a dependency update policy for my repositories. Ecosystems in use: [ECOSYSTEMS]. Number of repositories: [REPO_COUNT]. Test coverage and confidence level: [TEST_CONFIDENCE]. Who can review updates: [REVIEWERS]. How long we can leave a security alert open: [SECURITY_SLA]. Past incidents caused by upgrades: [PAST_INCIDENTS]. Deliver: a one-page policy with sections for Scope, Update cadence by type (security, patch, minor, major), Who approves what, Batching and grouping rules, Pinning and lockfile rules, Handling a failing update, and Exceptions. Then give a draft .github/dependabot.yml in a code block with comments, using weekly or monthly schedules that match my cadence, limits on open pull requests, and grouping where it helps. Flag every key name and option with [VERIFY] since the format evolves. Finish with a table with the columns Update type, Auto-merge allowed?, Required checks, Review needed, Target time to merge. Be careful with auto-merge: only suggest it for low risk types where my stated test confidence supports it, and explain the reasoning. This is defensive housekeeping for my own repositories; it is not a guarantee against vulnerabilities, and I should follow my organisation's security policy. Add a worked example with invented figures: 14 repositories, about 6 update pull requests per repository per month, 10 minutes of review each, and show the monthly review hours with and without grouping that cuts pull requests by 40 percent.
Fill in before use
Optional: type your details and the prompt above updates. Nothing is saved or sent.
Replace each bracketed placeholder with your own details, then paste into Any AI or another assistant.