I have a repo set up with Dependabot in GitHub. The config file is:
version: 2
updates:
- package-ecosystem: "npm"
directory: "apps"
schedule:
interval: "daily"
open-pull-requests-limit: 2
The PR can be created by Dependabot for updating a dependency version but it only changes the package.json file, not the yarn.lock file. I am using Node 18 and Yarn 4.
Based on this doc, the default version strategy should be auto. But it is not very clear about how to make it update yarn.lock file. It also doesn't mention what Yarn version we are using.
Below is an example of PR created by Dependabot:
