Skip to main content
Automating dependency management and security scanning is essential for modern software delivery. Integrating Mend with Azure Pipelines and activating GitHub Dependabot enables you to enforce security, quality, and compliance across your DevOps workflow.

​
1. Incorporating Mend into Azure Pipelines

Mend (formerly WhiteSource) is a robust extension in the Azure DevOps Marketplace that automates open-source component analysis. By embedding Mend into your pipeline, you ensure continuous security checks and policy enforcement.

​
1.1 Prerequisites & Installation

You need Project Administrator permissions in Azure DevOps to install and configure extensions.
  1. Open the Azure DevOps Marketplace.
  2. Search for Mend and select the extension.
  3. Click Install and choose your Azure DevOps organization.
  4. Under Project settings ▶ Extensions, configure your Mend API token.

​
1.2 Key Features of Mend

The image is a diagram explaining how Mend can be incorporated into Azure Pipelines, highlighting its features in security, quality, and compliance for open-source software. It emphasizes continuous detection, security notifications, and automated enforcement of standards.
By integrating Mend, your pipelines will block builds that violate security or license policies, ensuring that only compliant artifacts are deployed.

​
2. Activating GitHub Dependabot for Enhanced Security

GitHub Dependabot automates dependency version updates and vulnerability remediation in your repositories. It works seamlessly with GitHub Actions and supports multiple ecosystems (npm, Maven, Python, Docker, and more).

​
2.1 Enabling Dependabot

  1. Create a dependabot.yml in the root of your repository (e.g., .github/dependabot.yml).
  2. Define update intervals, package ecosystems, and target directories:
  3. Commit and push the configuration. Dependabot will start scanning and raising pull requests.
Ensure you have branch protection rules enabled; Dependabot PRs must comply with your CI checks.

​
2.2 Core Benefits of Dependabot

The image is an infographic titled "Activating GitHub Dependabot for Enhanced Security," outlining four steps: Updates Monitoring, Security Notifications, Pull Request Automation, and Assessment and Prioritization. Each step includes a brief description and an icon.

​
Conclusion

By combining Mend’s open-source security enforcement with GitHub Dependabot’s automated updates, you’ll achieve a fully automated DevSecOps pipeline. This proactive strategy helps you:
  • Detect and remediate vulnerabilities early
  • Enforce organizational policies without slowing development
  • Maintain up-to-date dependencies with minimal manual effort

Watch Video