What it does
Dependabot is GitHub's repository-based dependency update service. A checked-in `dependabot.yml` file tells it which package ecosystems and directories to watch and how often to look for updates. It opens pull requests for newer versions and can also propose fixes for known vulnerable dependencies. The maintainer still reviews the changes and runs project tests before merging. Basic version and security updates are included in GitHub's Free plan, while other security features have separate plan boundaries.
Start with one package ecosystem
Create .github/dependabot.yml in a repository with a supported dependency manifest. The official reference requires configuration version 2, an updates entry, the package ecosystem, the directory containing its manifest, and a schedule such as weekly. For example, a repository with a root package.json can start with npm and /, then add other ecosystems once the first pull requests are useful.
Dependabot checks the declared packages and opens pull requests with updated manifest or lockfile content. Review the release notes, run the repository's tests, and merge the change only when it fits the project's compatibility policy. The documentation says version updates have a default three-day cooldown; security updates are handled separately and are not delayed by that default. You can use groups to combine related updates, but the exact behavior depends on the configuration and ecosystem.
Dependabot also updates references to GitHub Actions in workflow files when GitHub Actions is configured as an ecosystem. This makes it relevant to CI maintenance as well as application dependencies, but it does not replace a CI runner: your existing test and build jobs still need to validate its pull requests.
GitHub's pricing page includes Dependabot security and version updates in the Free plan. Other supply-chain security features are not all equivalent to these basic update functions, so check the plan matrix before assuming an advanced security option is included. The docs require write access to configure the feature.
Strengths
- Uses a repository configuration file to schedule updates across supported package ecosystems.
- Creates reviewable pull requests rather than silently changing the default branch.
- Can update GitHub Actions references as well as application dependencies.
Watch out for
- The repository needs a supported manifest or workflow reference, and maintainers still need to review and test update pull requests.
- Access depends on GitHub repository permissions, and advanced security features have separate plan availability.
Best for
- Automating routine dependency update pull requests in GitHub repositories
- Keeping GitHub Actions references current alongside application packages
Sources
- GitHub Supply Chain Security (Oct 25, 2026)
- Dependabot Version Updates (Oct 25, 2026)
- Dependabot Options Reference (Oct 25, 2026)
- GitHub Plans and Pricing (Oct 25, 2026)