Help us improve
Share bugs, ideas, or general feedback.
From kitchen-sink
Use when adding, auditing, or editing .github/dependabot.yml — groups minor and patch updates per ecosystem (majors stay individual), and adds a 7-day cooldown so churning releases settle before a PR opens.
npx claudepluginhub oalders/kitchen-sink --plugin kitchen-sinkHow this skill is triggered — by the user, by Claude, or both
Slash command
/kitchen-sink:tune-dependabot-configThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
**Two changes applied to every `updates:` entry in `.github/dependabot.yml`:**
Guides technical evaluation of code review feedback: read fully, restate for understanding, verify against codebase, respond with reasoning or pushback before implementing.
Share bugs, ideas, or general feedback.
Two changes applied to every updates: entry in .github/dependabot.yml:
Core principle: Reduce dependabot PR noise on safe updates while preserving one-PR-per-package signal on breaking changes. Majors get individual PRs because each one is a breaking change that needs to be evaluated on its own — batching them hides which package failed CI.
When this skill is invoked, dispatch the work to a general-purpose subagent via the Agent tool. Do not run the transforms inline in the caller's context.
Why:
.github/dependabot.yml, walks every updates: entry, computes minimal edits per entry, writes the file, and runs a YAML parser sanity check. With several ecosystems in play, that is a meaningful amount of Read/Edit/Bash tool traffic the caller doesn't need to see.How to dispatch:
If the user explicitly asks to run inline (e.g. "do it here so I can watch"), honour that — the subagent dispatch is the default, not a hard requirement.
.github/dependabot.yml with no groups: or no cooldown: blockSkip when:
aws-sdk-* separated from rest); preserve their groups, only add what's missingopen-pull-requests-limit: 0 (paused) — leave it aloneInside each updates: entry, ensure a group exists that matches every dependency for minor and patch updates only:
groups:
minor-and-patch:
patterns:
- '*'
update-types:
- 'minor'
- 'patch'
Why explicit update-types: Without it, group behaviour depends on dependabot defaults that have shifted over time and differ between version-updates and security-updates. Listing the two update types unambiguously batches minor + patch and leaves majors as individual PRs.
Why exclude major: A grouped major-bump PR hides which package broke when CI fails, and reverting one package out of a batch is awkward. Individual PRs for majors keep the signal clean.
Exception — github-actions: Use two groups for the GitHub Actions ecosystem — one for major bumps, one for minor + patch:
groups:
major-updates:
patterns:
- '*'
update-types:
- 'major'
minor-and-patch:
patterns:
- '*'
update-types:
- 'minor'
- 'patch'
Why two groups: Related actions (actions/upload-artifact and actions/download-artifact, actions/cache/save and actions/cache/restore) ship coordinated major bumps where the artifact or cache format changes — merging one without the other breaks CI. Batching majors together keeps the coordinated pair atomic. Keeping major in its own group (rather than mixing all three) means a routine minor/patch PR can land without waiting for the major-bump PR to clear review, and a failing major-bump PR doesn't block patch updates.
If the user already has groups: Preserve them. Only add the catch-all if no existing group has patterns: ['*'] covering the required update types (minor + patch for most ecosystems; major + minor + patch for github-actions). A more-specific group always wins for matched dependencies, so adding a catch-all alongside is safe — it sweeps up everything the named groups don't claim. If the user has an existing catch-all that already includes major in its update-types, leave it — they made that choice deliberately.
Inside each updates: entry where applies-to is version-updates (the default), add:
cooldown:
default-days: 7
default-days: 7 is enough for every ecosystem — both the SemVer-aware ones (npm, Bundler, Cargo, Composer, Gomod, Gradle, Maven, NuGet, Pip, UV, etc.) and the ecosystems that only honour default-days (Docker, GitHub Actions, Helm, Terraform, Devcontainers, Bazel, Conda, Hex/Mix, Gitsubmodule, Docker Compose).
Do not add cooldown to security-update entries — dependabot ignores it there, and the whole point of security updates is to land fast.
groups: (per ecosystem entry)| Key | Purpose |
|---|---|
IDENTIFIER | Group name (letters, hyphens, underscores; must start and end with a letter) |
applies-to | version-updates (default) or security-updates |
dependency-type | production or development |
patterns | List of name globs to include (e.g. ["*"], ["aws-sdk-*"]) |
exclude-patterns | Globs to exclude |
update-types | Subset of ["major", "minor", "patch"] |
cooldown: (per ecosystem entry, version-updates only)| Key | Purpose |
|---|---|
default-days | Cooldown for any update without a more-specific rule |
semver-major-days | Major version cooldown (SemVer ecosystems only) |
semver-minor-days | Minor version cooldown (SemVer ecosystems only) |
semver-patch-days | Patch version cooldown (SemVer ecosystems only) |
include | Glob list to scope cooldown to (≤150 entries) |
exclude | Glob list to exclude (≤150 entries) |
This skill writes only default-days: 7. If the user later wants tighter patch / longer major windows, they can split it themselves.
For each - entry under updates: in .github/dependabot.yml:
Skip if paused. If the entry has open-pull-requests-limit: 0, leave it alone.
Determine update class. If applies-to: security-updates, only step 3 applies.
Ensure grouping. The required catch-all groups depend on package-ecosystem:
github-actions: two catch-alls — major-updates with update-types: [major], and minor-and-patch with update-types: [minor, patch].minor-and-patch with update-types: [minor, patch].Then, for each required catch-all:
patterns: ['*'] covers the required update-types, add the catch-all alongside the existing groups.Existing user-defined groups are always preserved.
Ensure cooldown (skip for security-updates entries).
cooldown: key exists, add cooldown: { default-days: 7 }.cooldown: exists with no default-days, add default-days: 7.Preserve everything else — comments, key order, schedule, directory, ignore, assignees, labels, etc.
Match the file's quoting style. Scan the existing file for quote usage on string values:
weekly, daily, npm) on existing keys.After editing, run a YAML parser sanity check (e.g. python3 -c 'import yaml,sys; yaml.safe_load(open(".github/dependabot.yml"))') to confirm the file still parses.
Before:
version: 2
updates:
- package-ecosystem: "npm"
directory: "/"
schedule:
interval: "weekly"
- package-ecosystem: "github-actions"
directory: "/"
schedule:
interval: "weekly"
After (file uses double quotes, so new strings use double quotes):
version: 2
updates:
- package-ecosystem: "npm"
directory: "/"
schedule:
interval: "weekly"
groups:
minor-and-patch:
patterns:
- "*"
update-types:
- "minor"
- "patch"
cooldown:
default-days: 7
- package-ecosystem: "github-actions"
directory: "/"
schedule:
interval: "weekly"
groups:
major-updates:
patterns:
- "*"
update-types:
- "major"
minor-and-patch:
patterns:
- "*"
update-types:
- "minor"
- "patch"
cooldown:
default-days: 7
npm major bumps arrive as individual PRs. GitHub Actions yields up to two PRs per run — one for batched major bumps (so coordinated artifact/cache releases land atomically) and one for routine minor + patch.
Before:
version: 2
updates:
- package-ecosystem: "npm"
directory: "/"
schedule:
interval: "daily"
groups:
aws-sdk:
patterns:
- "@aws-sdk/*"
After:
version: 2
updates:
- package-ecosystem: "npm"
directory: "/"
schedule:
interval: "daily"
groups:
aws-sdk:
patterns:
- "@aws-sdk/*"
minor-and-patch:
patterns:
- "*"
update-types:
- "minor"
- "patch"
cooldown:
default-days: 7
The aws-sdk group still wins for @aws-sdk/* packages; minor-and-patch sweeps up the rest. Majors for any package land as individual PRs.
Before:
- package-ecosystem: "pip"
directory: "/"
schedule:
interval: "weekly"
applies-to: security-updates
After: Same plus the catch-all group (security updates can also be grouped) but no cooldown: block — cooldown is ignored for security-updates and adding it would be misleading.
- package-ecosystem: "pip"
directory: "/"
schedule:
interval: "weekly"
applies-to: security-updates
groups:
minor-and-patch:
applies-to: security-updates
patterns:
- "*"
update-types:
- "minor"
- "patch"
Note applies-to: security-updates inside the group — groups default to version-updates, so an explicit match is required. Major security advisories still land as individual PRs so each can be triaged on its own.
Before:
- package-ecosystem: "cargo"
directory: "/"
schedule:
interval: "weekly"
cooldown:
semver-major-days: 14
semver-minor-days: 3
After: Add the catch-all group, but leave cooldown alone — the user has split major/minor deliberately. Don't overwrite their judgement with a flat 7.
| Mistake | Why it's wrong | Fix |
|---|---|---|
Adding cooldown: to a security-updates entry | Dependabot ignores it; misleads readers | Skip cooldown for applies-to: security-updates |
Replacing the user's existing groups with minor-and-patch | Destroys their per-package-family routing | Add alongside, don't replace |
Leaving update-types off the catch-all group | Behaviour ambiguous across dependabot versions | Always list [minor, patch] explicitly |
Including major in the catch-all update-types for non-actions ecosystems | Hides which package broke when a batched major-bump PR fails CI | Group only minor + patch; let majors arrive as individual PRs |
Skipping a major-updates group for github-actions | Coordinated action major releases (upload-artifact / download-artifact, cache save/restore) need to merge together or CI breaks | For github-actions, add a separate major-updates group |
Lumping major + minor + patch into a single github-actions group | A failing major-bump PR blocks routine patch updates from landing | Use two groups: major-updates and minor-and-patch |
| Mismatching the file's quote style when adding keys | Mixed quoting reads as careless and may break linters | Match existing quotes; if mixed, default to single |
Using default-days: 7 and semver-*-days together without thought | Conflicting signals; one will silently win | If the user has semver-*-days, leave cooldown alone entirely |
| Editing the file as a string and reflowing it | Loses comments, breaks key order users care about | Edit minimally — append the missing keys to each entry |
Adding the block when the entry has open-pull-requests-limit: 0 | The entry is intentionally paused | Skip paused entries |
After writing the file:
python3 -c 'import yaml; yaml.safe_load(open(".github/dependabot.yml"))'updates: entry and confirm:
patterns: ['*'] covers minor + patch (or another catch-all is in place)cooldown.default-days is set (or the user already has cooldown configured)