# Tame Dependabot: Group your updates, slow the cadence, keep security fast

[Github](https://yomu.fyi/company/github) · Bruno Borges · Jul 29, 2026

**Type:** Problem & solution

## Summary

Dependabot often floods repository maintainers with individual daily pull requests for single patch bumps, wasting review and continuous integration resources. Microsoft's GCToolkit project mitigated this issue by updating its dependabot.yml configuration to group dependency updates using wildcard patterns and slowing the schedule interval to monthly. The project also expanded coverage to include Maven alongside GitHub Actions so all relevant package ecosystems receive managed updates. Because Dependabot processes security alerts independently of regular version schedules and enforces a default three-day package cooldown, critical vulnerability fixes remain fast while routine maintenance noise drops significantly.

## Context

Microsoft's open-source GCToolkit repository experienced high maintenance noise, with roughly one in six commits being routine Dependabot version bumps caused by daily checks and ungrouped pull requests.

## Approach / What changed

The project modified its dependabot.yml to switch check intervals from daily to monthly, grouped all ecosystem updates into single pull requests using wildcard patterns, and added Maven tracking alongside GitHub Actions.

## Takeaways

- Configuring a \`groups\` block with wildcard patterns collapses multiple dependency version bumps into a single consolidated pull request per ecosystem.
- Dependabot security updates trigger immediately upon vulnerability disclosures and operate independently of scheduled version-update intervals.
- Dependabot enforces a default three-day package cooldown before raising version-update pull requests to help protect against newly published malicious or broken releases.

**Tags:** [CI/CD](https://yomu.fyi/topic/ci-cd), [Developer Experience](https://yomu.fyi/topic/developer-experience), [Java](https://yomu.fyi/topic/java), [Open Source](https://yomu.fyi/topic/open-source)

[Read original post](https://github.blog/security/supply-chain-security/tame-dependabot-group-your-updates-slow-the-cadence-keep-security-fast)