EngineeringScoreDependabot
Dependabot watches what a GitHub repository declares it depends on, and opens a pull request when one of those packages has a published fix.
Why our report names it
Our scan reads response headers and will tell you when they give away the server software, but the dependency tree behind them is invisible from outside. That gap reaches the report through the questionnaire instead, and Dependabot is what the answer points a GitHub-hosted repository at.
What it doesn't do
- GitHub's own limitations list is blunt about it: Dependabot alerts cannot catch every security issue, only advisories GitHub has reviewed will trigger one, and a new vulnerability can sit for a while before it reaches the Advisory Database at all.
- Dependabot reads what your manifest and lock files declare. GitHub says security updates fire only for dependencies specified in one of those, so a binary vendored by hand, a script pulled in at build time, or a service you call over the network is not in its picture.
- Outside npm, GitHub says Dependabot cannot update a transitive dependency where doing so would also mean updating its parent, and it does not scan archived repositories at all.
- It is a GitHub feature, so a repository hosted anywhere else needs something else. That is why our own report names Snyk in the same breath as Dependabot rather than treating the two as interchangeable.
What it does
- GitHub's documentation says Dependabot watches the default branch and raises an alert either when your dependency graph changes or when a new advisory lands in the GitHub Advisory Database, so a package nobody has touched in a year can start failing on its own.
- With security updates switched on, GitHub says Dependabot tries to open a pull request for every open alert that has a patch available, moving to the lowest version carrying the fix and linking that pull request back to the alert it would close.
- An alert can be handed to a person, a team or an agent, and GitHub applies auto-triage rules before notifications go out, so the low-risk ones can be dismissed without ever reaching an inbox.
More on the problem
Nothing here is gated behind us. Go straight to Dependabot and make your own mind up.
Sources
Every claim about Dependabot on this page was read on from the pages below. Products change and this page does not change with them, so treat the date as the claim's expiry rather than its publication.
- GitHub's Dependabot alerts documentation: when an alert is raised, and the limitations list stating that alerts cannot catch every security issue, that only GitHub-reviewed advisories trigger one, and that archived repositories are not scanned
- GitHub's Dependabot security updates documentation: that a pull request moves to the lowest version carrying the patch, that security updates fire only for dependencies declared in a manifest or lock file, and the transitive-dependency limit outside npm
Ready to see where you stand?
Scan your site and get your Engineering Score with a prioritized roadmap in under a minute, no signup required.