Security & Quality

Dependabot Security Updates

Automate dependency updates and security patches with GitHub Dependabot for continuous vulnerability remediation.

Claude Code Cursor Copilot

Overview

Dependabot is GitHub's automated dependency update tool that creates pull requests to keep your dependencies up to date and secure. It monitors your project's dependency files (package.json, requirements.txt, Gemfile, go.mod, etc.) and automatically opens PRs when new versions are available or security vulnerabilities are discovered.

Dependabot operates in two modes: version updates (scheduled PRs for all dependency updates) and security updates (immediate PRs when vulnerabilities are disclosed). Security updates are triggered by GitHub's Advisory Database and include detailed information about the vulnerability, affected versions, and the fix. PRs include changelogs, release notes, and compatibility scores to help with review.

Configuration is managed through a `.github/dependabot.yml` file that specifies which package ecosystems to monitor, update frequency, version strategies, and grouping rules. You can group related updates into single PRs, set allowed/ignored dependencies, configure auto-merge for patch updates, and assign specific reviewers. Dependabot supports 20+ package ecosystems including npm, pip, Maven, NuGet, Docker, Terraform, and GitHub Actions.

Who Is This For?

Automatically fix vulnerable dependencies with security PRs
Keep npm dependencies up to date with weekly version PRs
Group related dependency updates into single pull requests
Auto-merge patch updates that pass CI checks

Installation

Setup for Claude Code

mkdir -p .github && touch .github/dependabot.yml

Configuration

# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "weekly"
      day: "monday"
    open-pull-requests-limit: 10
    groups:
      dev-dependencies:
        dependency-type: "development"
    reviewers:
      - "your-username"
    labels:
      - "dependencies"