Dependabot — Playbook

In one sentence

Dependabot is GitHub's official bot that monitors your repository's dependencies.

When a vulnerability is found, it raises an alert and, when possible, automatically opens a fix PR. It also keeps stale dependencies regularly updated to newer versions.

Alerts vs Updates — what’s the difference?

Dependabot has 3 distinct features. They’re often confused, but they serve different purposes.

Feature	What does it do?	Trigger	Output
🚨 Security alerts	Notifies you of vulnerabilities in existing dependencies	When a new CVE is added to the GitHub Advisory Database	Security tab + email
🔧 Security updates	Automatically opens a PR to fix the vulnerability	When an alert fires (automatically)	PR (bumps vulnerable dep to fixed version)
⏰ Version updates	Opens PRs to keep up with new versions regardless of vulnerability	Schedule defined in config file (daily / weekly)	PR (old → latest)

🔑 Alerts = detection only; Updates = creates fix PRs. Security updates are layered on top of Alerts — they won’t run without Alerts enabled.

The role of the dependency graph

All of Dependabot’s decisions start from the dependency graph.

🗂️ Parses manifests and lock files — reads dependency definitions from package-lock.json, requirements.txt, go.mod, pom.xml, Gemfile.lock, and more
🔄 Resolves both direct and transitive dependencies — even if you don’t directly depend on lodash, it’s tracked if a dependency pulls it in
📚 Cross-references the GitHub Advisory Database — matches detected dependencies against published CVEs to identify vulnerabilities
🛂 Supported ecosystems — npm, pip, Maven, NuGet, Composer, Bundler, Go modules, Cargo, Gradle, Hex, Pub, Docker, GitHub Actions, and more

🌍 The Advisory Database aggregates vulnerability data from GitHub, the community, and MITRE’s CVE feeds.

Getting started (fastest path)

Step 1 — Enable security alerts / updates

Repo → Settings → Code security
  ✅ Dependency graph
  ✅ Dependabot alerts
  ✅ Dependabot security updates

Just check three boxes. No config file needed — it starts working immediately.

Step 2 — Add .github/dependabot.yml if you want version updates

version: 2
updates:
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "weekly"
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "monthly"

📦 Specify the ecosystem with package-ecosystem
📅 interval: daily / weekly / monthly
🏷️ Use groups to batch multiple packages into a single PR, or ignore to exclude specific packages

Step 3 — Enable for the whole Org / Enterprise

From Org → Settings → Code security, use default settings to apply to all repositories at once.

Eligibility and pricing

Feature	Public repo	Private repo (Personal / Free)	Private repo (Team / Enterprise)
Dependency graph	✅ On by default	✅ Free (opt-in)	✅ Free
Dependabot alerts	✅ Free	✅ Free	✅ Free
Dependabot security updates	✅ Free	✅ Free	✅ Free
Dependabot version updates	✅ Free	✅ Free	✅ Free

💰 Dependabot itself is completely free on every plan. No GitHub Advanced Security license required.
⚙️ Version update Dependabot jobs run on GitHub-hosted runners — free for public repos; private repos consume the standard Actions free tier (pay-as-you-go when exceeded).