Update Dependabot options reference for clarity

[cluse-heartflow]

Clarify behavior of 'increase-if-necessary' option in Dependabot.

Why:

Originally I misread this. I thought this setting would make Dependabot ignore minor versions. I didn't understand that with this setting enabled, Dependabot will still make a PR, but it will only update the lockfile, not the package.json.

Closes:

What's being changed (if available, include any code snippets, screenshots, or gifs):

Just changing the description of the increase-if-necessary option for Dependabot so that it is more obvious that this does not cause Dependabot to ignore minor versions.

Check off the following:

• A subject matter expert (SME) has reviewed the technical accuracy of the content in this PR. In most cases, the author can be the SME. Open source contributions may require an SME review from GitHub staff.
• The changes in this PR meet the docs fundamentals that are required for all content.
• All CI checks are passing and the changes look good in the review environment.

[welcome]

Thanks for opening this pull request! A GitHub docs team member should be by to give feedback soon. In the meantime, please check out the contributing guidelines.

[Copilot]

Pull Request Overview

This PR clarifies the description of the increase-if-necessary option in the Dependabot versioning strategy documentation to better explain its behavior with manifest and lockfile updates.

Key Changes:

• Expands the description of the increase-if-necessary versioning strategy option to clearly explain when Dependabot updates manifest files vs. lockfiles only

[github-actions]

How to review these changes 👓

Thank you for your contribution. To review these changes, choose one of the following options:

• Spin up a codespace
• Set up a local development environment

A Hubber will need to deploy your changes internally to review.

Table of review links

Note: Please update the URL for your staging server or codespace.

The table shows the files in the content directory that were changed in this pull request. This helps you review your changes on a staging server. Changes to the data directory are not included in this table.

Source	Review	Production	What Changed
code-security/dependabot/working-with-dependabot/dependabot-options-reference.md	fpt ghec ghes@ 3.17 3.16 3.15 3.14	fpt ghec ghes@ 3.17 3.16 3.15 3.14

Key: fpt: Free, Pro, Team; ghec: GitHub Enterprise Cloud; ghes: GitHub Enterprise Server

🤖 This comment is automatically generated.

[Sharra-writes]

@cluse-heartflow Thanks for opening a PR! This wording definitely looks opaque as-is. I checked with the Dependabot team, and they proposed this wording to be more concise:

Leave the version requirement unchanged if it already allows the new release (Dependabot still updates the resolved version). Otherwise widen the requirement.

Do you think this is clearer, or is there a change you would like to make for better clarity? We're trying to keep it short since it appears in a table and we don't want a big block of text. That's unfortunately also a barrier to understanding. We could probably make it a little longer than this, though.

[cluse-heartflow]

Sure, sounds good to me.

[github-actions]

Thanks for opening a pull request! We've triaged this issue for technical review by a subject matter expert 👀

[github-actions]

Thanks very much for contributing! Your pull request has been merged 🎉 You should see your changes appear on the site in approximately 24 hours. If you're looking for your next contribution, check out our help wanted issues ⚡