Skip to main content
This guide demonstrates how to patch repository vulnerabilities using Dependabot’s security update feature in GitHub Advanced Security (GHAS). You’ll enable security updates at the repository level, optionally enable grouped updates, and watch Dependabot open pull requests (PRs) that remediate open alerts. What you’ll learn:
  • How to enable Dependabot security updates
  • How Dependabot creates PRs to bump vulnerable dependencies
  • How to review, validate, and merge Dependabot PRs while respecting CI and branch protection

​
1. Enable Dependabot security updates

Open the repository’s Advanced Security settings and toggle on the “Security updates” option. If you prefer fewer pull requests when one dependency bump can remediate multiple alerts, also enable “Grouped security updates.” Grouped updates consolidate related fixes into a single PR.
A dark-mode screenshot of a GitHub repository's Security settings showing Dependabot configuration (Dependabot alerts, malware alerts, security updates, grouped/version updates) with enable/disable buttons. The page also shows links and a gear button for Dependabot rules.
Dependabot may take several minutes to analyze your dependency graph and generate PRs after you enable security updates. If you enable grouped updates, expect fewer consolidated PRs instead of one PR per alert.

​
2. Wait for Dependabot to analyze and create PRs

After enabling security updates, Dependabot scans your dependency manifests (for example package.json / package-lock.json, pyproject.toml / poetry.lock, etc.). Depending on repository size and dependency count, this can take a few minutes. When complete, Dependabot will open one or more PRs to bump affected packages to safe versions. In the demo repository, Dependabot opened PRs to update Mongoose and Lodash.
A dark-mode GitHub repository page showing the "Pull requests" tab for the game-devstudio/ghas-guardrail-demo repo. The list shows three open PRs, including dependabot bumps for mongoose and lodash and a restore app.js change.

​
3. Review a Dependabot pull request

Open a Dependabot PR to review:
  • The description (which usually references the advisory/CVE)
  • The list of changed files (package manifests and lockfiles)
  • Any linked security advisories or remediation details
Typical changes in an npm project include updates to both package.json and package-lock.json. Example diff (illustrative):
Dependabot PRs should include the minimum necessary version jump to remediate the vulnerability.

​
4. Validate CI, CodeQL, and branch protection checks

When you try to merge a Dependabot PR, automated checks such as CI pipelines or security scans (for example CodeQL) may block merging until they pass. This is expected behavior for repositories with branch protection and security checks enabled.
A dark-mode GitHub pull request page showing a Dependabot update to bump mongoose with a warning that merging is blocked while CodeQL scanning waits for results. The UI shows an option to bypass rules and merge, plus a comment box at the bottom.
Avoid bypassing branch protection or security checks except in emergency situations. Always run and validate CI, tests, and security workflows after dependency updates to ensure the application behavior remains correct.
If checks fail, investigate the causes (test regressions, breaking changes in dependencies, or CI environment issues) before merging. If you have the necessary permissions and an urgent fix is required, bypassing protections is possible, but it is not recommended for production repositories.

​
5. Merge, test, and monitor

After PR checks pass and you have reviewed the changes:
  1. Merge the Dependabot PR.
  2. Run your full test and build workflows (local and CI) to validate runtime behavior.
  3. Monitor deployment metrics, error reporting, and logs for unexpected changes.
In the demo, the maintainer merged the Dependabot PRs for Mongoose and Lodash.
A GitHub pull request page showing a merged Dependabot update that bumps lodash from version 4.17.15 to 4.18.1 in an npm_and_yarn group. The PR details, comments, and labels are visible in a dark-themed interface.
After merging, GitHub (and GHAS) will automatically close the corresponding Dependabot alerts for the remediated vulnerabilities. In the demo, alerts for Lodash and Mongoose were resolved and the open alert count dropped to zero.

​
Quick reference — workflow summary

​
Additional resources

That covers the standard repository-level workflow for using Dependabot security updates together with GitHub Advanced Security to identify and remediate dependency vulnerabilities.

Watch Video