Is dependabot.yml mandatory for GitHub Dependabot?

Question

Is adding of the dependabot.yml file mandatory for having GitHub Dependabot updates? Or is it just an additional option to change default values?

https://docs.github.com/en/github/administering-a-repository/configuration-options-for-dependency-updates

Answer 1

The configuration file is necessary so that Dependabot knows which environments to update. This is a minimalist example from the GitHub documentation to update the dependencies of the GitHub Actions on a daily basis:

version: 2
updates:

  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      # Check for updates to GitHub Actions every weekday
      interval: "daily"

You can also see the necessary configurations in the table of the GitHub documentation .