What is Dependabot, and what three features does it provide in GitHub?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Dependabot is GitHub's automated dependency guardian. It alerts you to vulnerable dependencies, opens PRs to patch security vulnerabilities, and opens PRs to bump dependency versions. Three jobs, all automated.
Full explanation below image
Full Explanation
GitHub Dependabot provides three distinct but complementary features: (1) Dependabot Alerts — notifies repository maintainers when a dependency has a known security vulnerability, based on the GitHub Advisory Database. (2) Dependabot Security Updates — automatically opens pull requests to upgrade vulnerable dependencies to patched versions. (3) Dependabot Version Updates — opens pull requests to keep dependencies up to date with the latest available versions (not just security patches), configured via dependabot.yml. Together, these three features form a comprehensive automated dependency management system. They cover package managers like npm, pip, Maven, Gradle, NuGet, Bundler, and more.