How to turn off dependabot PRs but still get alerts?

[nello]

The control of this feature is incredibly confusing, at least to me. Reading the documentation, I would expect that alerting could be turned on quite simply but that I would then have to create a YAML file to configure automatic patching PRs. But somehow the converse is true.

I have never turned on anything to do with PRs yet they get submitted constantly for one of my repos, even though I have toggled them off in the UI. How is this meant to work?

[shmulik-klein]

Try to use the main settings page under you profile - with Disable All (and make sure the checkbox is off)

[shmulik-klein]

Yep, I just meant that you'll disable Dependabot security updates, this option controls whether it should open PRs, the other option will keep you updated.

I hope it helps 🤞

[jhutchings1]

@shmulik-klein is correct. The Dependabot security updates setting configures whether or not Dependabot opens pull requests. The Dependabot alerts setting configures whether you receive alerts. Hope this helps!

[jhutchings1]

I should add that if you have a dependabot.yml file checked into your repository, then that tells Dependabot to send pull requests as well. Delete that file and you'll clear out that configuration.

[nello]

Thanks for the extra information. I've deleted all dependabot yamls for our repos now. They appear to have been added by people who thought adding them was best practice without realising the consequences.

I really do appreciate your help but this would have been much easier to resolve with if a) Github's controls were labelled properly (seriously "Dependabot security updates" could mean just about anything!), b) the controls were scoped correctly so that repo controls were not overridden by global ones, and c) the mere presence of a file didn't override all other settings.

[jhutchings1]

Appreciate the feedback. I've relayed that feedback to the team, because I agree that the UI is super confusing when a config file is checked in. We'll look at whether there are clearer messages we can provide here. Thanks!

[AndreaGriffiths11]

Adding that, you can always customize how dependencies are maintained: check out https://www.youtube.com/watch?v=Qcq0WfXz-aM&list=PL0lo9MOBetEG2cjOxhvHNVS4NUYiZPm6z
and https:github.co/likeapro

[nello]

Thank for your responses, but honestly this is way too hard. I don't want to have to create and maintain a yaml for Github to not make unwarranted PRs against my codebases. I don't want to go searching outside my repo for ways to make the dependency-checking configuration in the repo work in an expected way. I've turned everything to do with dependency checking from Github off for all my repos wherever I can find it and will rely on outside tooling from now on.