Grouping tells Dependabot to combine related updates into one pull request, so you review and test once instead of ten times. Group minor and patch updates together, keep major updates separate, and leave security fixes visible. For a solo developer this is often the difference between keeping up and giving up.
Why update fatigue happens
Each pull request costs attention: open it, read it, wait for tests, merge. Ten small packages mean ten rounds. When the rounds feel endless, pull requests sit, and GitHub notes Dependabot temporarily pauses updates if maintainers stop interacting. The result is a repository that quietly drifts out of date.
What the groups option offers
GitHub's options reference lists these keys under groups: applies-to, dependency-type, exclude-patterns, group-by, patterns and update-types. The ones you will use most are patterns, to group by package name, and update-types, to group minor and patch changes.
version: 2
updates:
- package-ecosystem: "npm"
directory: "/"
schedule:
interval: "weekly"
groups:
minor-and-patch:
update-types:
- "minor"
- "patch"
Check the current reference for exact syntax before you copy this, as options can change.
What to group and what to keep apart
| Group together | Keep separate |
|---|---|
| Minor and patch updates | Major version updates |
| Packages in one family, such as a linting toolkit | Anything that touches authentication or crypto |
| Dev dependencies | Packages that have broken you before |
Dev dependencies can often be grouped since they are lower impact, though read them before merging, as build tools run with access to your tokens.
A rhythm that works
- Weekly schedule, grouped pull requests.
- Review the grouped pull request in your weekly slot.
- If tests pass and the changelog looks harmless, merge.
- If tests fail, use the pull request history to find the culprit and split it out.
Mind the trade-off
A big group is harder to debug when something breaks. Keep groups modest, and do not group across risky boundaries. If a group fails, ungroup the suspect package and proceed.
Pair it with a low limit
The open pull requests limit defaults to five. With grouping you can usually leave it there or lower it. Fewer open requests keeps your queue short enough to finish.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do grouped pull requests include security fixes?
Behaviour can differ between version updates and security updates. Check how your repository handles them and keep security fixes easy to spot.
How do I know a group is safe to merge?
Passing tests, a quick changelog read and a staging deploy where possible. Green tests alone are not a guarantee.
Safeguard autonomous remediation proposes fix pull requests too, off by default with every category on Manual, and the free scan is at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
