---
title: Integrating Dependabot with Mergify
description: How to automate your dependencies update using Mergify.
---

<IntegrationLogo src={dependabotLogo} alt="Dependabot logo"/>

[Dependabot](https://github.com/features/security) helps you keep your
dependencies up-to-date by automatically opening pull requests for outdated
dependencies. When combined with Mergify, you can automate more of the
process.

## Automating Dependabot Pull Request Merges

If you have GitHub's branch protection set up to require approvals, you can use
Mergify to automatically approve Dependabot PRs.

```yaml
pull_request_rules:
  - name: Automatically approve Dependabot PRs
    conditions:
      - author = dependabot[bot]
    actions:
      review:
        type: APPROVE
```

## Filtering Dependabot PRs

Mergify exposes condition attributes describing each Dependabot update:
`dependabot-dependency-name`, `dependabot-dependency-type`, and
`dependabot-update-type`. You can use these in your [merge
protection](/merge-protections/custom-rules) conditions to filter which
Dependabot PRs are allowed to merge. For instance, you might want to block
major version bumps:

```yaml
merge_protections:
  - name: auto-approve-minor-dependabot-updates
    if:
      - author = dependabot[bot]
    success_conditions:
      - dependabot-update-type != version-update:semver-major
```

## Batching Dependency Updates

For projects where there are frequent updates to a large number of small
libraries, you can batch these updates together. Using Mergify's merge queue
feature, you can automatically batch and test these updates together, reducing
CI load and ensuring compatibility.

For example, you could set up a merge queue to batch those PRs 10 by 10:

```yaml
queue_rules:
  - name: dep-update
    batch_size: 10
    # Wait for up to 30 minutes for the batch to fill up
    batch_max_wait_time: 30 min
    queue_conditions:
      - author = dependabot[bot]
```

## Disable Dependabot's Automatic Rebase

By default, Dependabot will try to rebase its pull requests every time there's
a new commit to the main branch. In high-velocity projects with a lot of
updates, this can lead to unnecessary CI runs. It's recommended to disable
Dependabot's automatic rebase feature and instead rely on Mergify to queue and
merge these updates efficiently.

To disable automatic rebasing in Dependabot, use the
[`rebase-strategy`](https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#rebase-strategy)
settings and turn off automatic rebase.

```yaml
version: 2
updates:
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "weekly"
    # Disable rebasing for npm pull requests
    rebase-strategy: "disabled"
```

## Configuring `MERGIFY_TOKEN` for Dependabot

If you use Mergify features that require a `MERGIFY_TOKEN` in your GitHub
Actions workflows, such as [CI Insights](/ci-insights/setup/github-actions) or
[Scopes](/merge-queue/scopes), you need to add the token to your **Dependabot
secrets** in addition to your regular GitHub Actions secrets.

Dependabot workflows run in a restricted environment and **cannot access regular
GitHub Actions secrets**. Without this extra step, any workflow triggered by a
Dependabot pull request will fail to authenticate with the Mergify API.

To configure it:

1. Go to your repository **Settings → Secrets and variables → Dependabot**.

2. Click **New repository secret**.

3. Set the name to `MERGIFY_TOKEN` and paste the same application key you use in
   your GitHub Actions secrets.

:::note
  This applies to any workflow that references `${{secrets.MERGIFY_TOKEN}}`
  and runs on Dependabot pull requests, including scopes detection, CI Insights
  test uploads, and any other Mergify CI integration.
:::