Skip to main content
Managing open-source vulnerabilities is a major challenge when much of your application is built from third-party components. Modern applications frequently reuse libraries and packages: in some organizations up to 80% of code comes from external sources.
A presentation slide reading "Most of Your Code Is Borrowed" with a large "80%" displayed. Below it is a grid diagram labeled "Your application" showing many component blocks, a few highlighted in blue and several outlined in red with warning icons.
This article explains how Dependabot uses the GitHub Advisory Database to detect and remediate vulnerable dependencies, and how you can configure and operationalize those protections in your projects. Why supply-chain security matters
  • Most apps are assembled from open-source packages rather than written entirely from scratch.
  • Vulnerabilities in a widely used dependency can affect many projects.
  • Automated tooling that links vulnerability intelligence to your manifests is the first layer of defense.
Example minimal Node.js manifest:
Dependabot: source of intelligence Dependabot’s vulnerability intelligence is powered by the GitHub Advisory Database — a curated set of advisories (including mapped CVE entries) that links known vulnerabilities to specific package ecosystems and versions.
A screenshot of a "GitHub Advisory Database" panel titled "Its Source of Truth," showing badges for "Curated" and "Globally recognized." The panel lists several CVE vulnerability entries (e.g., CVE-2021-23337, CVE-2021-44228).
How Dependabot works — three modes Dependabot operates in three complementary modes. Configure and use each mode according to your risk tolerance and release processes. Detailed examples and snippets
  1. Dependabot alerts (passive detection)
  • What it does: Scans your manifest files (for example, package.json for Node.js or requirements.txt for Python), cross-references package versions against the GitHub Advisory Database, and raises an alert when a known vulnerable version is in use.
Example vulnerable manifests: package.json (excerpt)
requirements.txt
  1. Dependabot security updates (active remediation)
  • What it does: When an alert is triggered, Dependabot can automatically open a pull request that upgrades just the vulnerable dependency to the nearest safe version. Your workflow is to review the PR, run CI, and merge if everything looks good.
Example of the change in a PR (diff-style):
  1. Dependabot version updates (preventive maintenance)
  • What it does: Proactively opens pull requests to keep dependencies up to date even when there are no known CVEs. This reduces the risk of large, risky upgrades later and lessens the chance you’ll be multiple major versions behind when a zero-day appears.
Example configuration (.github/dependabot.yml):
Why incremental updates matter Keeping dependencies incrementally updated reduces the complexity and risk of emergency upgrades when vulnerabilities are disclosed. A smaller, frequent upgrade surface is easier to test and review than a large, infrequent one.
A slide titled "Why It Matters" showing a horizontal version timeline with your app at v12 (highlighted in red with a lightning bolt) and the current release at v17 (green). Intermediate versions v13–v16 appear as neutral gray circles between them.
Dependabot’s vulnerability intelligence comes from the GitHub Advisory Database. Use alerts to discover exposed dependencies, security updates to automatically remediate known issues, and version updates to proactively reduce future exposure.
Links and references

Watch Video