Is Dependabot actually watching all of your repo?

Dependabot only updates the package-ecosystem and directory pairs your dependabot.yml lists. A second package.json in a subfolder, a Dockerfile added later, or a go.mod in a service directory is silently skipped, and there is no warning. Paste your config and your file list and this page shows exactly what is skipped, lints the config itself, and writes a starter file.

Nothing is uploaded. What you paste is read in this browser and never leaves your device, and this tool makes no network calls of its own.

1. Paste your config and your file list

.github/dependabot.yml (leave empty to just generate one) Repository file list (one path per line, e.g. the output of git ls-files)

Without a file list only the config itself is linted. node_modules, vendor, dist and similar folders are ignored.

Paste a config and a file list, then click Check.

Starter dependabot.yml

One entry per ecosystem found in your file list, weekly, with a 7-day cooldown and minor/patch grouping. Save it as .github/dependabot.yml and adjust to taste.

Prefer a CLI, or want this in your own CI?

Same logic, zero dependencies, one import:

node cli.mjs                    # check .github/dependabot.yml against the current directory
node cli.mjs /path/to/repo      # a specific checkout
node cli.mjs --format json      # machine-readable
node cli.mjs --fail-on-risk     # exit 2 on any error or warning
node cli.mjs --generate         # print a starter config for the manifests it finds

Get cli.mjs and check.mjs from the repo. Node 18 or newer, nothing to install, no network calls. Run it with --fail-on-risk in your own CI so a new folder with a manifest cannot merge without an update entry.

Common questions

Why does Dependabot skip some of my dependencies?

Version updates only run for the package-ecosystem and directory pairs listed under updates:. A manifest in a directory or ecosystem that is not listed is never checked, and nothing warns you. A monorepo with a second package.json in a subfolder, or a Dockerfile added after the config was written, is the usual cause.

Does `directory: /` cover subfolders?

No. It covers manifests in the repository root only (for github-actions it covers .github/workflows). Use one entry per folder, or the directories: key with globs such as /* or /**.

What does a cooldown do?

cooldown: default-days: N holds a routine update until the release is N days old, giving the ecosystem time to yank a compromised or broken release. Security updates are not delayed.

Why group updates?

Without groups: every dependency bump is its own pull request. A group with update-types: [minor, patch] folds them into one weekly PR.

Does this tool read my repository?

No. You paste the config and a file list and it all runs in this browser. The check is a static comparison of the two texts: it does not know which dependencies are outdated or vulnerable, and it does not talk to GitHub.