> ## Documentation Index > Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt > Use this file to discover all available pages before exploring further. # Demo GHAS Dependabot Security Updates > Guide showing how to enable and use Dependabot security updates in GitHub Advanced Security to generate, review, and merge pull requests that remediate vulnerable dependencies. This guide demonstrates how to patch repository vulnerabilities using Dependabot's security update feature in GitHub Advanced Security (GHAS). You'll enable security updates at the repository level, optionally enable grouped updates, and watch Dependabot open pull requests (PRs) that remediate open alerts. What you'll learn: * How to enable Dependabot security updates * How Dependabot creates PRs to bump vulnerable dependencies * How to review, validate, and merge Dependabot PRs while respecting CI and branch protection ## 1. Enable Dependabot security updates Open the repository's Advanced Security settings and toggle on the "Security updates" option. If you prefer fewer pull requests when one dependency bump can remediate multiple alerts, also enable "Grouped security updates." Grouped updates consolidate related fixes into a single PR. ![A dark-mode screenshot of a GitHub repository's Security settings showing Dependabot configuration (Dependabot alerts, malware alerts, security updates, grouped/version updates) with enable/disable buttons. The page also shows links and a gear button for Dependabot rules.](https://mintcdn.com/kodekloud-c4ac6d9a/TlnHw4JjIHBx3Cta/images/GitHub-Administration-Certification/Security-and-Compliance/Demo-GHAS-Dependabot-Security-Updates/github-dependabot-security-settings-dark.jpg?fit=max\&auto=format\&n=TlnHw4JjIHBx3Cta\&q=85\&s=557035341ee6ac7223f083882840188d) Dependabot may take several minutes to analyze your dependency graph and generate PRs after you enable security updates. If you enable grouped updates, expect fewer consolidated PRs instead of one PR per alert. ## 2. Wait for Dependabot to analyze and create PRs After enabling security updates, Dependabot scans your dependency manifests (for example `package.json` / `package-lock.json`, `pyproject.toml` / `poetry.lock`, etc.). Depending on repository size and dependency count, this can take a few minutes. When complete, Dependabot will open one or more PRs to bump affected packages to safe versions. In the demo repository, Dependabot opened PRs to update Mongoose and Lodash. ![A dark-mode GitHub repository page showing the "Pull requests" tab for the game-devstudio/ghas-guardrail-demo repo. The list shows three open PRs, including dependabot bumps for mongoose and lodash and a restore app.js change.](https://mintcdn.com/kodekloud-c4ac6d9a/TlnHw4JjIHBx3Cta/images/GitHub-Administration-Certification/Security-and-Compliance/Demo-GHAS-Dependabot-Security-Updates/github-prs-dependabot-mongoose-lodash-restore.jpg?fit=max\&auto=format\&n=TlnHw4JjIHBx3Cta\&q=85\&s=c8d8e79615caa5424c276fa05c2d056d) ## 3. Review a Dependabot pull request Open a Dependabot PR to review: * The description (which usually references the advisory/CVE) * The list of changed files (package manifests and lockfiles) * Any linked security advisories or remediation details Typical changes in an npm project include updates to both `package.json` and `package-lock.json`. Example diff (illustrative): ```diff theme={null} - "lodash": "4.17.15", + "lodash": "4.18.1" ``` Dependabot PRs should include the minimum necessary version jump to remediate the vulnerability. ## 4. Validate CI, CodeQL, and branch protection checks When you try to merge a Dependabot PR, automated checks such as CI pipelines or security scans (for example CodeQL) may block merging until they pass. This is expected behavior for repositories with branch protection and security checks enabled. ![A dark-mode GitHub pull request page showing a Dependabot update to bump mongoose with a warning that merging is blocked while CodeQL scanning waits for results. The UI shows an option to bypass rules and merge, plus a comment box at the bottom.](https://mintcdn.com/kodekloud-c4ac6d9a/TlnHw4JjIHBx3Cta/images/GitHub-Administration-Certification/Security-and-Compliance/Demo-GHAS-Dependabot-Security-Updates/github-dependabot-mongoose-bump-codeql-blocked.jpg?fit=max\&auto=format\&n=TlnHw4JjIHBx3Cta\&q=85\&s=3efc4d6d226db0089393a05d1c7e667f) Avoid bypassing branch protection or security checks except in emergency situations. Always run and validate CI, tests, and security workflows after dependency updates to ensure the application behavior remains correct. If checks fail, investigate the causes (test regressions, breaking changes in dependencies, or CI environment issues) before merging. If you have the necessary permissions and an urgent fix is required, bypassing protections is possible, but it is not recommended for production repositories. ## 5. Merge, test, and monitor After PR checks pass and you have reviewed the changes: 1. Merge the Dependabot PR. 2. Run your full test and build workflows (local and CI) to validate runtime behavior. 3. Monitor deployment metrics, error reporting, and logs for unexpected changes. In the demo, the maintainer merged the Dependabot PRs for Mongoose and Lodash. ![A GitHub pull request page showing a merged Dependabot update that bumps lodash from version 4.17.15 to 4.18.1 in an npm\_and\_yarn group. The PR details, comments, and labels are visible in a dark-themed interface.](https://mintcdn.com/kodekloud-c4ac6d9a/TlnHw4JjIHBx3Cta/images/GitHub-Administration-Certification/Security-and-Compliance/Demo-GHAS-Dependabot-Security-Updates/github-dependabot-lodash-bump-v41715-v4181.jpg?fit=max\&auto=format\&n=TlnHw4JjIHBx3Cta\&q=85\&s=0d674bafb787aa5533e75614a9fe4bf6) After merging, GitHub (and GHAS) will automatically close the corresponding Dependabot alerts for the remediated vulnerabilities. In the demo, alerts for Lodash and Mongoose were resolved and the open alert count dropped to zero. ## Quick reference — workflow summary | Step | Action | Notes | | - | - | - | | 1 | Enable "Security updates" in Advanced Security | Optionally enable `Grouped security updates` to consolidate fixes. | | 2 | Wait for Dependabot to analyze dependencies | Allow several minutes for analysis and PR creation. | | 3 | Review Dependabot PRs | Inspect changed manifests, lockfiles, and advisory links. | | 4 | Validate CI / CodeQL / branch protections | Fix failing checks before merging; avoid bypassing protections. | | 5 | Merge and run full validation | Run tests & monitor after deployment. | ## Additional resources * [Dependabot overview — GitHub Docs](https://docs.github.com/en/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically) * [Configuring security updates — GitHub Docs](https://docs.github.com/en/code-security/supply-chain-security/configuration-options-for-dependency-updates) * [GitHub Advanced Security](https://docs.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code) That covers the standard repository-level workflow for using Dependabot security updates together with GitHub Advanced Security to identify and remediate dependency vulnerabilities. > [card] [Watch Video](https://learn.kodekloud.com/user/courses/github-administration-certification/module/d477d0b2-5ca0-43b2-aed7-7d82887400f7/lesson/04a982b1-0f0a-4f14-aeab-5ccc0799e0d1) This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.