Clarification on dependabot.yaml and code security settings

[piotrekkr]

Select Topic Area

Question

Body

Hello. Looking at docs and it is not clear to me if I need to enable dependabot updates and grouping in repo/org setting or I can simply just create dependabot.yaml file and it will work out of the box?
If I have this in org configuration:

And this in repo configuration

Do I need to click Enable for Dependabot security updates and Grouped security updates in each repository that contains dependabot.yaml? Will just dependabot.yaml be enough? Thank you.

[carogalvin]

@piotrekkr it depends if you want Dependabot PRs that provide updates that resolve alerts (i.e. "security updates") or PRs that update your dependencies to the latest version (i.e. "version updates"). They are enabled separately. For security updates, check the box here and it'll work without dependabot.yml. For version updates, you must check in a dependabot.yml.

[piotrekkr]

Thanks for reply. What happens when I have both, dependabot.yaml and settings enabled? dependabot.yaml takes precedence over settings in repo?

[carogalvin]

Then you will get both security & version updates, and your configuration from the YAML will apply. For more information on how to set up the YAML to configure version and/or security updates, you can check out our docs: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file