Dependabot expands from security fixes to routine version updates
Up-to-date dependencies are one of the most effective ways to keep software secure, yet developers frequently treat the work as a chore: in Sonatype’s 2019 State of the Software Supply Chain Report, 52% of developers said updating dependencies is painful. GitHub’s Dependabot automation already handled the security-critical slice of that work, but only for packages with known vulnerabilities. Now it is being extended to cover everything else.
Dependabot version updates, now in public beta, regularly update all packages in a repository, even those with no known vulnerabilities. The feature is enabled by checking a dependabot.yml configuration file into the repository.
The configuration file specifies which ecosystems to update (for example, Go modules or npm packages), where the dependency manifest lives, and how frequently Dependabot should check for releases. On the configured schedule, Dependabot compares installed versions against what’s available and opens pull requests to bump the manifest when newer versions exist.
Dependabot alerts and security updates
GitHub’s earlier vulnerability tooling — previously called security alerts for vulnerable dependencies and automated security updates — continues to work as before, but under new names: Dependabot alerts and Dependabot security updates. GitHub monitors the National Vulnerability Database and other sources for flaws in open-source packages, sends an alert when a dependency is affected, and opens a pull request with the closest non-vulnerable version when a fix is feasible. Since the automated security updates launch in November 2019, users have merged more than 776,000 of those pull requests.
If Dependabot alerts or security updates are not yet enabled, they can be turned on from a repository’s Settings page under the Security & analysis tab.
Upgrading from dependabot-preview
Version updates replace the configuration approach used by dependabot-preview and Dependabot.com. Existing users have two steps: enable security updates and enable version updates.
Security updates are enabled from the same Security & analysis tab and are already active in most repositories. For version updates, Dependabot will open a pull request containing an updated configuration file in the next few days. Users who want to act immediately can generate that pull request from their Dependabot.com dashboard using the Update config file button.
In the GitHub-native Dependabot, version update settings live entirely in the configuration file, which is close to the dependabot-preview format with a few improvements; those changes appear automatically in the update pull request. Update logs that previously lived on the Dependabot.com dashboard are available from the repository’s Insights page: click the Dependency graph tab, then Dependabot.
Version updates are free for every repository on GitHub.
