Dependabot Preview is being retired in favor of the GitHub-native version

Since Dependabot Preview launched, it has served more than 30,000 organizations, with over seven million pull requests merged. After the Dependabot team joined GitHub in May 2019, work began on an updated, GitHub-native version of the service. The migration from Dependabot Preview onto that GitHub-native product starts now.

As of today, the Dependabot Preview app and dependabot.com are no longer accepting new customers. Both will be shut down on August 3rd, 2021. Existing users must merge the "Upgrade to GitHub-native Dependabot" pull request in each repository before that date to continue receiving package update pull requests. After the shutdown, any open pull requests from the Dependabot Preview bot will remain open, but the bot itself will stop working on GitHub accounts and organizations.

GIF showing how to merge Dependabot pull request to upgrade to GitHub-native Dependabot

Configuration for GitHub Dependabot is handled through a configuration file that is very similar to the one used by Dependabot Preview, but with some changes and improvements. Those adjustments are applied automatically when you process the upgrade pull request. The update logs previously available on the dependabot.com dashboard have also moved: you can now find them under your repository's Insights page, in the Dependency graph tab, under Dependabot.

GIF showing how to navigate to the Dependency graph tab to see update logs

What does not carry over

With the recent addition of private registry support, almost every Dependabot Preview capability is present in the GitHub-native version. A few features, however, are not:

  • Live updates: There is no immediate plan to bring these back. Running GitHub Dependabot daily will still surface new packages within a day of their release.
  • PHP environment variable registries: This feature has not been ported over. While alternatives are being investigated, GitHub Actions can be used to fetch dependencies from these registries in the meantime.
  • Auto-merge: Because verifying dependencies before merging is always recommended, auto-merge will not be supported for the foreseeable future. Users with thoroughly vetted dependencies—or those relying solely on internal packages—can look to third-party auto-merge apps or GitHub Actions.

Dependency upkeep remains a key component of software supply chain security for both open source and enterprise projects. The GitHub-native Dependabot roadmap includes additional ecosystem support, improvements to notifications, and Dependabot for GitHub Enterprise Server.

Questions about migration can be directed to GitHub Support. More information is available in the Dependabot documentation, and upcoming work is tracked on the public roadmap.