After merging repos, give Dependabot one entry per package ecosystem that lists every directory holding a manifest. A config copied from a single-package repo names the root only, so updates for everything under services/ silently stop. Build the directory list from a lockfile search, then group updates so the new volume is manageable.
What the reference says
GitHub's Dependabot options reference lists the required keys: a version, an updates section, a package ecosystem, a schedule interval, and either directories or directory under each ecosystem entry. It says the location setting is required, and that without it Dependabot cannot create version update pull requests. It points to examples under defining multiple locations for manifest files.
The practical effect: nothing complains when a directory is missing. The directory simply never gets updates.
Steps
- Find every manifest. Search the monorepo for lockfiles and manifests per ecosystem. Our guide on finding every lockfile in a monorepo shows how.
- Write one entry per ecosystem with a list of directories. Use the plural directories option rather than copying an entry per folder.
- Set a schedule per ecosystem. Weekly is a common starting point for npm, but pick what your team can review.
- Group updates so a single pull request carries related bumps. See grouped dependency update PRs across many directories and reduce update PR noise.
- Cap open pull requests. See how many open update PRs to allow.
- Route reviews. CODEOWNERS entries decide who is asked. See CODEOWNERS for bot-opened pull requests.
- Check after a week. Compare the directories that received pull requests with the full manifest list. Any directory with none, and no good reason, is a gap.
A sketch
version: 2
updates:
- package-ecosystem: "npm"
directories:
- "/services/payments"
- "/services/search"
- "/packages/*"
schedule:
interval: "weekly"
Check the reference for the exact syntax your plan supports, including wildcard patterns, before you rely on it.
Security updates versus version updates
Version updates follow your config. Alerts and security updates are separate features with their own settings, so do not assume that a missing directory in this file means no alerts. Verify both in the repository's security settings.
Keep coverage honest
Add the directory list to your coverage statement, see scan coverage statement. Safeguard's SBOM and dependency scanning cover manifests across the repository, and autonomous remediation can open fix pull requests (off by default, every category on Manual).
Common mistakes
- Copying the old file once per service into the root, creating duplicates that fight each other. Keep one file at the repository root.
- Forgetting ecosystems that are not the main language, such as a Dockerfile, a GitHub Actions workflow, or a Terraform folder. Each is its own package ecosystem in the config.
- Listing a directory that was renamed during the move. A stale path means no updates and no error that you will notice.
- Leaving internal workspace packages out of the review rules. Version bumps for them still change what ships.
How to verify
Pick three directories at random and check that each has either received an update pull request or has a good reason not to, such as everything being up to date. Do the same check again after a month. Treat any silent directory as a bug in the configuration until shown otherwise.
Quick check
Will Dependabot warn me about a missing directory?
Not that I know of from the reference. Verify coverage yourself by comparing the manifest list with the pull requests received.
One entry per directory, or one per ecosystem?
One per ecosystem with a list of directories keeps the file short and easier to review.
Sources
Last reviewed: 19 October 2026.
