Dependabot Core — Automated Dependency Update Engine

Introduction

Dependabot Core is the open-source engine that powers GitHub's automated dependency update service. It scans project manifests and lockfiles, identifies outdated or vulnerable dependencies, and generates pull requests with the updated versions. The core library supports over 15 package ecosystems and handles the complex task of resolving version constraints across dependency trees.

What Dependabot Core Does

• Scans manifests and lockfiles to identify outdated dependencies
• Resolves version constraints to find compatible updates
• Generates pull requests with changelogs and release notes included
• Supports 15+ package ecosystems including npm, pip, Maven, Cargo, and Go modules
• Handles private registry authentication through a credential proxy

Architecture Overview

Dependabot Core is a Ruby library organized around four key operations: fetching dependency files from a repository, parsing them to extract current versions, checking registries for newer versions, and generating updated files. Each package ecosystem has its own file fetcher, file parser, update checker, and file updater. A credential proxy keeps secrets isolated from the core logic. The Dependabot CLI wraps this library for self-hosted deployments.

Self-Hosting & Configuration

• Enable on GitHub repos by adding a .github/dependabot.yml configuration file
• For self-hosted use, install the Dependabot CLI from the official repository
• Configure update schedules as daily, weekly, or monthly per ecosystem
• Set version strategies: increase, increase-if-necessary, widen, or auto
• Use allow and ignore rules to control which dependencies get updated

Key Features

• Multi-ecosystem support covering all major package managers
• Security update integration with GitHub's vulnerability database
• Grouped updates to batch related dependency changes into single PRs
• Private registry support for npm, Maven, NuGet, Docker, and more
• Configurable reviewers, labels, and branch naming for generated PRs

Comparison with Similar Tools

• Renovate — more configuration options and custom managers; Dependabot is simpler to start
• npm audit fix — limited to npm security fixes; no PR generation or scheduling
• Snyk — commercial with open-source tier; focuses on security over general updates
• WhiteSource Bolt — vulnerability scanning only; no automated version updates
• Manual updates — error-prone and time-consuming for projects with many dependencies

FAQ

Q: Can I use Dependabot outside of GitHub? A: Yes. The Dependabot CLI can run against any Git repository and post updates to other platforms.

Q: How does Dependabot handle breaking changes? A: It creates a PR with the update and relies on your CI pipeline to catch breaking changes. It includes changelogs to help with manual review.

Q: Can I limit Dependabot to security updates only? A: Yes. Set open-pull-requests-limit: 0 for version updates and enable security updates separately in your repository settings.

Q: Does Dependabot support monorepos? A: Yes. Configure multiple directory entries in your dependabot.yml to target different subdirectories.

Sources

• https://github.com/dependabot/dependabot-core
• https://docs.github.com/en/code-security/dependabot