> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Securing Dependencies Dependabot

> Explains how GitHub Dependabot uses the Advisory Database to detect vulnerabilities and automate dependency alerts, security update pull requests, and scheduled version updates.

Managing open-source vulnerabilities is a major challenge when much of an application is built from third‑party libraries. Dependabot helps automate detection and remediation of vulnerable dependencies by using curated vulnerability data from the GitHub Advisory Database.

![A slide titled "Most of Your Code Is Borrowed" with a large "80%" and a grid diagram of app components, some outlined in red with warning icons and some in blue. The image illustrates that many parts of an application are reused or borrowed code.](https://mintcdn.com/kodekloud-c4ac6d9a/TlnHw4JjIHBx3Cta/images/GitHub-Administration-Certification/Security-and-Compliance/Securing-Dependencies-Dependabot/most-code-borrowed-80-grid-components.jpg?fit=max\&auto=format\&n=TlnHw4JjIHBx3Cta\&q=85\&s=c99de99131233d04c6c1167619ca631c)

Modern applications are often assembled from packages rather than written from scratch. For example, a Node.js service manifest might look like:

```json theme={null}
{
  "name": "checkout-service",
  "dependencies": {
    "express": "^4.18.2",
    "lodash": "4.17.19"
  }
}
```

Dependabot’s intelligence comes from the GitHub Advisory Database — a curated repository of CVEs and advisories mapped to package ecosystems and specific versions. That mapping is what lets Dependabot detect vulnerable versions listed in your manifests and act upon them.

Dependabot uses the GitHub Advisory Database to map known vulnerabilities to package names and versions. This mapping enables Dependabot to identify vulnerable entries in manifest files like `package.json`, `requirements.txt`, and other ecosystem manifests.

## How Dependabot works — three operating modes

Dependabot can operate in three distinct modes. Understanding each mode helps you configure the right level of automation and ensure your CI and review workflows stay effective.

| Mode | Purpose | What it does | Result / Example |
| - | - | - | - |
| Alerts (passive) | Notify teams of known risks | Scans manifests and compares listed versions against advisory mappings. Opens alerts when matches occur. | An alert appears in Security > Dependabot alerts for `lodash@4.17.19`. |
| Security updates (active remediation) | Automatically patch known vulnerabilities | When an alert is triggered for a known vulnerability, Dependabot opens a PR that updates to the nearest non‑vulnerable version. | PR that changes `"lodash": "4.17.19"` to `"lodash": "4.17.21"`, with changelog links. |
| Version updates (preventive) | Keep dependencies current to reduce upgrade friction | Periodic PRs that bump package versions (daily/weekly/monthly) even when no CVE is present. | Recurring weekly PRs to upgrade minor and patch versions. |

### 1) Dependabot alerts (passive)

* What it does: Scans manifest files (e.g., `package.json`, `requirements.txt`), compares the versions against the GitHub Advisory Database, and creates alerts when vulnerable versions are present.
* Example manifests scanned:

```json theme={null}
{
  "dependencies": {
    "lodash": "4.17.19",
    "express": "^4.18.2"
  }
}
```

```text theme={null}
# requirements.txt
Django==2.2.10
requests==2.19.1
```

When an alert is raised, your team receives a notification and can choose remediation steps (manual upgrade, security PRs, or deferred action).

### 2) Dependabot security updates (active remediation)

* What it does: Automatically opens a pull request to update a vulnerable package to the nearest safe version when an advisory is matched. The PR includes diffs, changelog links, and occasionally compatibility notes.
* Typical workflow: review the PR, let CI run automated tests, and merge if green.

Example diff produced by a Dependabot security update:

```diff theme={null}
-  "lodash": "4.17.19"
+  "lodash": "4.17.21"
```

### 3) Dependabot version updates (preventive maintenance)

* What it does: Configurable scheduled PRs that keep dependencies up to date even when there is no known vulnerability. This reduces version drift and simplifies future upgrades.
* Example configuration file: `.github/dependabot.yml`

```yaml theme={null}
version: 2
updates:
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "weekly"
```

Keeping dependencies reasonably current reduces the risk that a new vulnerability forces large, risky upgrades across major versions.

Balance automated updates with developer review capacity. Enabling security update PRs with CI validation is an effective baseline: PRs let your pipeline verify upgrades before merge, minimizing disruption while improving remediation speed.

## Practical tips and exam-focused takeaways

* Source of truth: Dependabot’s vulnerability mapping is the GitHub Advisory Database. Learn how advisories map to ecosystem package names and versions.
* Alerts: Passive notifications that signal the presence of a known vulnerability in your manifests.
* Security updates: Automated PRs that patch known vulnerabilities — fast remediation with minimal manual effort.
* Version updates: Scheduled PRs for maintenance to reduce technical debt and upgrade friction.
* Workflow recommendation: Enable security update PRs, run CI on those PRs, require code review, and configure scheduling for routine version updates.

## Links and references

* [Dependabot — GitHub Docs](https://docs.github.com/en/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/about-dependabot)
* [GitHub Advisory Database](https://github.com/advisories)
* [Dependabot configuration (dependabot.yml)](https://docs.github.com/en/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/configuration-options-for-dependency-updates)

> [card] [Watch Video](https://learn.kodekloud.com/user/courses/github-administration-certification/module/d477d0b2-5ca0-43b2-aed7-7d82887400f7/lesson/76f670a1-5e22-42b7-b82d-5a5d518cec8a)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.