dependabot.yml
Teire reads your existing dependabot.yml and honours it, so moving from Dependabot changes nothing you already decided. teire.yml wins where both say something, and Teire says so.
If your repository already has .github/dependabot.yml, Teire reads it on every scan and every fix. Each updates entry applies to the projects its package-ecosystem and directory (or directories) cover.
What Teire applies
| Setting | What Teire does |
|---|---|
ignore | No upgrade for that package (names with * work), those versions, or those update types (version-update:semver-major) |
allow | Version updates only for the names or dependency types listed (production, development, direct, indirect) |
cooldown | Waits that many days per update type (semver-major-days, …), with its include and exclude lists |
versioning-strategy | widen and increase as Teire's upgrades.versioning; lockfile-only keeps every target inside your range |
open-pull-requests-limit: 0 | Version updates off for that ecosystem; security fixes still open |
commit-message | The prefix on Teire's commit and pull request title (prefix-development for a development dependency), with (deps) or (deps-dev) when include: scope is set; after a lowercase prefix the title starts lowercase, chore(deps): upgrade zod from 3.23.8 to 4.1.0 |
labels | The labels on Teire's pull request, for the entry that covers its directory |
groups, vendor, exclude-paths, insecure-external-code-execution | Passed to dependabot-core's updater, which Teire runs for the dependency-file change |
registries | Read with the credentials saved in Private registries |
When teire.yml says otherwise
teire.yml wins for the same setting, and the scan says which file decided:
cooldown: teire.yml's upgrades.cooldownDays is used, not .github/dependabot.yml's cooldownSettings Teire doesn't apply are listed too, in the scan's coverage, never dropped silently: multi-ecosystem-groups (Teire opens one pull request per package), assignees, reviewers, milestone and pull-request-branch-name.
Commit messages
With no prefix in teire.yml or dependabot.yml, Teire follows the style of your repository's last 100 commits by people (merges and bots left out), as Dependabot does:
| Over 30% of them look like | Teire's prefix |
|---|---|
Conventional Commits (feat: …, fix(api): …) | The type your own dependency commits use, else build(deps): , or chore(deps): when you use chore and never build |
ESLint style (Fix: …, Update: …) | Upgrade: |
gitmoji (✨ …, :bug: …) | ⬆️ |
Every commit ends with the updated-dependencies block that dependabot/fetch-metadata reads, so auto-merge workflows built on it work with Teire's pull requests too. fetch-metadata checks the author by default; set skip-verification: true for Teire's.
Dependabot's own pull requests
When Dependabot already has a pull request open for the same package, Teire's says so: Supersedes Dependabot's #123. Teire's is verified against your code; Dependabot closes its own once the dependency is updated.
Running both
You don't have to remove Dependabot. Many teams keep its security alerts and let Teire open the upgrades. To stop Dependabot's version-update pull requests without losing anything, set open-pull-requests-limit: 0 in its entries: Teire then reads that as "version updates off" only when teire.yml doesn't set its own pullRequests.limit.
Configuration (teire.yml)
One optional file decides what Teire upgrades, how many PRs it opens, which checks it runs and what it reads. Every key has a default, and a mistake never stops a scan.
Private registries
Teire finds the registries your repositories install from, and reads them with a credential an admin saves once. The secret is sealed for Teire's worker and never reaches your code.