Dependabot

Related: Dependency Management, GitHub

Dependabot is built into GitHub and can be used on every repository. It does two separate things:

• Security updates: alerts, and pull requests that fix them, when a dependency has a known vulnerability. Enable these under Settings → Advanced Security.
• Version updates: pull requests to keep dependencies current, whether or not there is a known vulnerability. Configure these in .github/dependabot.yml.

Enable both. Not every vulnerability gets a security advisory, and some fixes take a long time to reach one. Keeping dependencies current means you’re already on a patched version when an advisory arrives, and that each update is small.

Setup

Add a .github/dependabot.yml with one entry per package ecosystem in the repository, including github-actions so pinned actions are kept up to date too:

.github/dependabot.yml

version: 2
updates:
  - package-ecosystem: npm
    directory: "/"
    schedule:
      interval: weekly
    cooldown:
      default-days: 3
    groups:
      minor-and-patch:
        update-types: [minor, patch]

  - package-ecosystem: github-actions
    directory: "/"
    schedule:
      interval: weekly
    cooldown:
      default-days: 3

Use a cooldown

cooldown makes Dependabot wait a number of days after a release before opening a pull request for it. That gives the community time to discover and pull a malicious release from the registry before we install it. It does not delay security updates: known vulnerabilities still get a pull request right away.

Group updates

groups bundles related updates into one pull request instead of one per package. This keeps the number of PRs manageable, so they get reviewed and merged rather than piling up.

Check that Dependabot sees your dependencies

Dependabot can only alert on what is in the dependency graph. Check it under Insights → Dependency graph.

Caution

Even if a dependency shows up in the graph, its version may not. Without a version, you won’t get vulnerability alerts for it.

For JavaScript projects, the most common cause of a missing or incomplete graph is a missing lockfile. Commit package-lock.json, pnpm-lock.yaml or yarn.lock so the exact versions, including transitive dependencies, are visible.

Some ecosystems (e.g. Gradle) aren’t detected automatically. For these, submit the graph from a workflow using the Dependency submission API.

Troubleshooting

Getting alerts for packages you don’t recognize? They are almost always transitive dependencies. Run npm explain <package> (or pnpm why <package>) to see which of your direct dependencies pulls it in.