Dependabot

In a nutshell

Alerts vs Updates — what’s the difference?

Dependabot has 3 distinct features. They’re often confused, but they serve different purposes.

🔑 Alerts = detection only; Updates = creates fix PRs. Security updates are layered on top of Alerts — they won’t run without Alerts enabled.

The role of the dependency graph

All of Dependabot’s decisions start from the dependency graph.

• 🗂️ Parses manifests and lock files — reads dependency definitions from package-lock.json, requirements.txt, go.mod, pom.xml, Gemfile.lock, and more
• 🔄 Resolves both direct and transitive dependencies — even if you don’t directly depend on lodash, it’s tracked if a dependency pulls it in
• 📚 Cross-references the GitHub Advisory Database — matches detected dependencies against published CVEs to identify vulnerabilities
• 🛂 Supported ecosystems — npm, pip, Maven, NuGet, Composer, Bundler, Go modules, Cargo, Gradle, Hex, Pub, Docker, GitHub Actions, and more

🌍 The Advisory Database aggregates vulnerability data from GitHub, the community, and MITRE’s CVE feeds.

Getting started (fastest path)

Step 1 — Enable security alerts / updates

Repo → Settings → Code security
  ✅ Dependency graph
  ✅ Dependabot alerts
  ✅ Dependabot security updates

Just check three boxes. No config file needed — it starts working immediately.

Step 2 — Add .github/dependabot.yml if you want version updates

version: 2
updates:
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "weekly"
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "monthly"

• 📦 Specify the ecosystem with package-ecosystem
• 📅 interval: daily / weekly / monthly
• 🏷️ Use groups to batch multiple packages into a single PR, or ignore to exclude specific packages

Step 3 — Enable for the whole Org / Enterprise

From Org → Settings → Code security, use default settings to apply to all repositories at once.

Companion: Dependency Review 📖 Docs

Dependency Review is the PR-time counterpart to Dependabot — it blocks merges before bad dependencies get in. Runs on every PR, on any base branch (not just main).

• 🚨 Vulnerable packages added or upgraded by the PR — configurable fail-on-severity
• 📜 License compliance — allow / deny lists (e.g. deny GPL-3.0 in a proprietary repo)
• 📦 Full dep diff incl. transitive deps resolved from lockfiles

Drop in actions/dependency-review-action and make it a required status check; org owners can enforce it across all repos via repository rulesets.

⚠️ PR-time gate — not a continuous watcher. Always pair it with Dependabot alerts, which catch CVEs published after merge.

Open source license compliance 📖 Docs

GA since 2026-10-16. A companion to Dependabot: govern dependency licenses before merge, not just vulnerabilities.

Scope: new or changed PR dependencies, including detected transitive dependencies. Not a copied-code or binary scanner.

AI triage: assign alerts to an agent

Every Dependabot alert has an “Assign to agent” button — hand it to Copilot / Claude / Codex and the agent reads the advisory + your repo to triage and remediate on demand, per alert.

• 🔍 What the agent typically does — reachability check (“is the vulnerable function actually called from my code path?”), exploitability assessment in your context, then a draft fix PR that handles breaking changes, downgrades, and refactors
• 🏁 Race multiple agents on the same alert and compare the resulting PRs
• 🧹 Auto-triage rules — separately, auto-dismiss / snooze low-impact alerts by severity, ecosystem, dependency scope (runtime vs dev) so the agents only see alerts worth looking at
• 👀 Treat agent fixes as first-pass: human review + tests still required before merge

🎯 Alert → Assign to agent → reachability + fix → draft PR → human review → merge. The bottleneck shifts from patch synthesis to approval.

💰 Free for public repos. Private repos need GitHub Code Security (or the legacy Advanced Security bundle).

Eligibility and pricing 📖 Docs

Core Dependabot is free on every plan. Only Code Security premium features cost extra.

Enterprise license compliance is not part of free Dependabot: it requires Enterprise Cloud + Code Security, including for public repositories.

⚙️ On standard or self-hosted runners, jobs don’t use Actions minutes. Only larger runners are billed.
🤖 Assign to agent needs Code Security + a Copilot plan with coding agent.