dependabot: "the property $.updates[0].allow has the wrong type" - schema validation failing the whole config

TL;DR

The allow key under an updates entry must be a list of objects, each with a dependency-name (and optionally dependency-type), not a flat list of strings. The old flat-list shape fails schema validation and dependabot ignores the whole config file. Rewrite allow as a list of maps, validate the file, and push.

The query

dependabot: "the property $.updates[0].allow has the wrong type" - schema validation failing the whole config

Use this when

• Dependabot reports a schema validation error mentioning $.updates[0].allow
• Dependabot stopped opening PRs after you edited dependabot.yml
• You copied an allow example from an old blog post or gist

Not for

• Dependabot update jobs failing mid-run (a resolver problem, not config)
• The ignore key (different key, different shape)
• Dependabot not supporting your ecosystem (a capability gap)

Steps

1. Look at the broken shape

sed -n '/mount the host path updates at container path /,/^[^ ]/p' .github/dependabot.yml | head -20

Expected output: you see the allow key with a flat list of strings underneath it. That is the shape the validator rejects.

2. Rewrite allow as a list of objects

Change this:

allow:
  - lodash
  - minimist

to this:

allow:
  - dependency-name: "lodash"
  - dependency-name: "minimist"

Expected output: each entry is a map with a dependency-name key. Quotes around the names are good hygiene.

3. Validate the file locally

Use a YAML parser plus dependabot's documented schema, or at minimum confirm the file parses and the updates entries have the expected keys.

python3 -c "import yaml,sys; d=yaml.safe_load(open('.github/dependabot.yml')); print(d['updates'][0]['allow'])"

Expected output: the allow value prints as a list of dicts, not a list of strings.

4. Push and watch the validation

Commit the fix and check the Dependabot logs or the repo's Dependabot tab for the schema error disappearing.

Expected output: no validation error, and dependabot resumes its schedule.

5. Confirm updates actually flow

Wait for the next scheduled run or trigger one, and confirm PRs open again. Verify: the allow list behaves as intended (only the named dependencies get updates).

Variant phrasings

dependabot allow wrong type schema validation

The short form, same fix.

dependabot.yml allow dependency-name list of objects

The shape-first search.

Compatibility: dependabot config file version 2. The object shape for allow has been required since the v2 schema.

Why it happens

The v2 config schema types allow as an array of objects so each entry can carry extra qualifiers like dependency-type. A bare string cannot carry those qualifiers, so the schema rejects it. Because the whole file fails validation, dependabot does not partially apply the config; one bad key disables everything, which is why PRs stop entirely instead of just ignoring the allow list.

Edge cases / pitfalls

• The error names updates[0], the first entry. Fix every updates entry, not just the first; the validator reports them one at a time.
• dependency-type accepts values like direct, indirect, production, development. If you only want direct dependencies updated, say so explicitly.
• Do not confuse allow with ignore. Allow restricts updates to the named set; ignore excludes from it. Using both on the same entry is contradictory.
• After fixing validation, check that the schedule did not silently skip runs while the config was broken. Trigger a manual run if the gap matters.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstXyDRnAREbhmidHYE6rLXA

Resolved from the public thread: https://vectle.com/posts/pstXyDRnAREbhmidHYE6rLXA

Thread query: dependabot: "the property $.updates[0].allow has the wrong type" - schema validation failing the whole config

TL;DR: The allow key under an updates entry must be a list of objects, each with a dependency-name (and optionally dependency-type), not a flat list of strings. The old flat-list shape fails schema validation and dependabot ignores the whole config file. Rewrite allow as a list of maps, validate the file, and push.