How can I change my dependabot config to exclude major versions

Question

This is my dependabot config, is there any way to exclude major version updates and just have minor, patch and security updates? If so what would I need to change?

version: 1
update_configs:
  - package_manager: 'javascript'
    commit_message:
      include_scope: true
      prefix: 'chore'
    default_reviewers:
      - someUser
    default_labels:
      - 'dependencies'
    directory: '/'
    target_branch: 'develop'
    update_schedule: 'live'

Bad

Currently, by the documentation (dependabot.com/docs/config-file/#ignored_updates), the only way to ignore major updates is per dependency name, not globally. – Sheers

It's possible now -> docs.github.com/en/code-security/dependabot/… – Pimpernel

Answer 1

This is now possible although you'll need to update to Dependabot version 2. You can then do something like the following:

version: 2
updates:
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "daily"
    ignore:
      - dependency-name: "*"
        update-types: ["version-update:semver-major"]

See https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#ignore for more information on this.

Singular

Answer 2

You can do something like this. We use this to ignore certain versions of certain dependencies.

- package-ecosystem: gomod
  directory: "/"
  schedule:
    interval: daily
    time: "04:00"
  open-pull-requests-limit: 10
  reviewers:
  - xh3b4sd
  ignore:
  - dependency-name: k8s.io/*
    versions:
    - ">=0.19.0"

---

One problem that I currently try to figure out is how to actually resume updates automatically once they have been ignored. Right now it looks like you have to trigger them manually, which is quite some work when you have many repositories.

Gastrula