Dependabot

In a nutshell

Alerts vs Updates — what’s the difference?

Dependabot has 3 distinct features. They’re often confused, but they serve different purposes.

🔑 Alerts = detection only; Updates = creates fix PRs. Security updates are layered on top of Alerts — they won’t run without Alerts enabled.

The role of the dependency graph

All of Dependabot’s decisions start from the dependency graph.

• 🗂️ Parses manifests and lock files — reads dependency definitions from package-lock.json, requirements.txt, go.mod, pom.xml, Gemfile.lock, and more
• 🔄 Resolves both direct and transitive dependencies — even if you don’t directly depend on lodash, it’s tracked if a dependency pulls it in
• 📚 Cross-references the GitHub Advisory Database — matches detected dependencies against published CVEs to identify vulnerabilities
• 🛂 Supported ecosystems — npm, pip, Maven, NuGet, Composer, Bundler, Go modules, Cargo, Gradle, Hex, Pub, Docker, GitHub Actions, and more

🌍 The Advisory Database aggregates vulnerability data from GitHub, the community, and MITRE’s CVE feeds.

Getting started (fastest path)

Step 1 — Enable security alerts / updates

Repo → Settings → Code security
  ✅ Dependency graph
  ✅ Dependabot alerts
  ✅ Dependabot security updates

Just check three boxes. No config file needed — it starts working immediately.

Step 2 — Add .github/dependabot.yml if you want version updates

version: 2
updates:
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "weekly"
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "monthly"

• 📦 Specify the ecosystem with package-ecosystem
• 📅 interval: daily / weekly / monthly
• 🏷️ Use groups to batch multiple packages into a single PR, or ignore to exclude specific packages

Step 3 — Enable for the whole Org / Enterprise

From Org → Settings → Code security, use default settings to apply to all repositories at once.

Companion: Dependency Review

Dependency Review is the PR-time counterpart to Dependabot — it blocks merges before bad dependencies get in. Runs on every PR, on any base branch (not just main).

• 🚨 Vulnerable packages added or upgraded by the PR — configurable fail-on-severity
• 📜 License compliance — allow / deny lists (e.g. deny GPL-3.0 in a proprietary repo)
• 📦 Full dep diff incl. transitive deps resolved from lockfiles

Drop in actions/dependency-review-action and make it a required status check; org owners can enforce it across all repos via repository rulesets.

⚠️ PR-time gate — not a continuous watcher. Always pair it with Dependabot alerts, which catch CVEs published after merge.

AI triage: assign alerts to an agent

Every Dependabot alert has an “Assign to agent” button — hand it to Copilot / Claude / Codex and the agent reads the advisory + your repo to triage and remediate on demand, per alert.

• 🔍 What the agent typically does — reachability check (“is the vulnerable function actually called from my code path?”), exploitability assessment in your context, then a draft fix PR that handles breaking changes, downgrades, and refactors
• 🏁 Race multiple agents on the same alert and compare the resulting PRs
• 🧹 Auto-triage rules — separately, auto-dismiss / snooze low-impact alerts by severity, ecosystem, dependency scope (runtime vs dev) so the agents only see alerts worth looking at
• 👀 Treat agent fixes as first-pass: human review + tests still required before merge

🎯 Alert → Assign to agent → reachability + fix → draft PR → human review → merge. The bottleneck shifts from patch synthesis to approval.

💰 Free for public repos. Private repos need GitHub Code Security (or the legacy Advanced Security bundle).

Eligibility and pricing

💰 Dependabot itself is completely free on every plan. No GitHub Advanced Security license required.
⚙️ Version update Dependabot jobs run on GitHub-hosted runners — free for public repos; private repos consume the standard Actions free tier (pay-as-you-go when exceeded).