Skip to main content
Managing open-source vulnerabilities is a major challenge when much of an application is built from third‑party libraries. Dependabot helps automate detection and remediation of vulnerable dependencies by using curated vulnerability data from the GitHub Advisory Database.
A slide titled "Most of Your Code Is Borrowed" with a large "80%" and a grid diagram of app components, some outlined in red with warning icons and some in blue. The image illustrates that many parts of an application are reused or borrowed code.
Modern applications are often assembled from packages rather than written from scratch. For example, a Node.js service manifest might look like:
Dependabot’s intelligence comes from the GitHub Advisory Database — a curated repository of CVEs and advisories mapped to package ecosystems and specific versions. That mapping is what lets Dependabot detect vulnerable versions listed in your manifests and act upon them.
Dependabot uses the GitHub Advisory Database to map known vulnerabilities to package names and versions. This mapping enables Dependabot to identify vulnerable entries in manifest files like package.json, requirements.txt, and other ecosystem manifests.

​
How Dependabot works — three operating modes

Dependabot can operate in three distinct modes. Understanding each mode helps you configure the right level of automation and ensure your CI and review workflows stay effective.

​
1) Dependabot alerts (passive)

  • What it does: Scans manifest files (e.g., package.json, requirements.txt), compares the versions against the GitHub Advisory Database, and creates alerts when vulnerable versions are present.
  • Example manifests scanned:
When an alert is raised, your team receives a notification and can choose remediation steps (manual upgrade, security PRs, or deferred action).

​
2) Dependabot security updates (active remediation)

  • What it does: Automatically opens a pull request to update a vulnerable package to the nearest safe version when an advisory is matched. The PR includes diffs, changelog links, and occasionally compatibility notes.
  • Typical workflow: review the PR, let CI run automated tests, and merge if green.
Example diff produced by a Dependabot security update:

​
3) Dependabot version updates (preventive maintenance)

  • What it does: Configurable scheduled PRs that keep dependencies up to date even when there is no known vulnerability. This reduces version drift and simplifies future upgrades.
  • Example configuration file: .github/dependabot.yml
Keeping dependencies reasonably current reduces the risk that a new vulnerability forces large, risky upgrades across major versions.
Balance automated updates with developer review capacity. Enabling security update PRs with CI validation is an effective baseline: PRs let your pipeline verify upgrades before merge, minimizing disruption while improving remediation speed.

​
Practical tips and exam-focused takeaways

  • Source of truth: Dependabot’s vulnerability mapping is the GitHub Advisory Database. Learn how advisories map to ecosystem package names and versions.
  • Alerts: Passive notifications that signal the presence of a known vulnerability in your manifests.
  • Security updates: Automated PRs that patch known vulnerabilities — fast remediation with minimal manual effort.
  • Version updates: Scheduled PRs for maintenance to reduce technical debt and upgrade friction.
  • Workflow recommendation: Enable security update PRs, run CI on those PRs, require code review, and configure scheduling for routine version updates.

Watch Video