Dependabot Configuration Builder

How to use Dependabot Configuration Builder

Generate an actual version 2 Dependabot YAML draft from explicit update directories, schedules and selected repository settings. Prepare the source file for a real dependency-update workflow while retaining each authored ecosystem and location. Generating a draft does not turn on a bot, verify repository access or tell you which releases are safe to adopt.

1. Provide optional update-model json, selected updates model as json.
2. Choose the supported mode and run the tool. Review its assumptions and any reported errors.
3. Copy the result or download a separate output; reset to clear the current form.

Good to know

• One UTF-8 JSON model up to50,000 bytes,10,000 values and40 levels. Root has updates;1–20 records have ecosystem, directory, schedule and optional labels/openPullRequests. Exact plain integer JSON tokens are required for numeric controls.
• Selected ecosystems: npm, pip, docker, github-actions, cargo, gomod. Directories are literal slash-rooted ASCII components, without traversal, trailing slash, wildcards or repeated separators. GitHub Actions requires /. Same-ecosystem directories must be unique and nonoverlapping.
• Schedules select daily, weekly or monthly. Weekly requires an explicit lowercase weekday; day is refused otherwise. Optional time is exact 24-hour HH: MM and timezone is checked only against this runtime Intl data, not the platform timezone database.
• Optional labels: 0–20 unique single-line strings up to100 UTF-8 bytes each. Optional openPullRequests: integer 0–1000. Existing labels, manifests, platform limits/permissions and update behavior remain unverified.
• No registry credentials, group/allow/ignore/cron/cooldown/target-branch/external-code options or existing-YAML merge. The current platform supports additional options that this selected generator intentionally omits. Generated YAML is at most 100,000 UTF-8 bytes.
• The actual quoted YAML belongs in .github/dependabot.yml only after your review. Nothing is enabled, published or submitted; dependency releases still need their own project validation.
• A same-origin module Worker loads its selected code, including the YAML writer for Dependabot, before ready within 10 seconds. A separate2-second computation deadline follows. Source is never evaluated, fetched, submitted, uploaded or automatically saved.
• Structured text output is limited to 500,000 characters. Reduce the supplied source when that separate output budget is exceeded.
• Inputs are processed on this device and are not automatically saved or uploaded.