Dependabot
ELI5 — The Vibe Check
Dependabot is GitHub's robot that checks your dependencies for updates and security vulnerabilities, then opens PRs to fix them. It's like having a responsible adult who actually reads those 'update available' notifications and does something about them.
Real Talk
Dependabot is GitHub's automated dependency management tool that creates pull requests for version updates and security patches. It supports multiple ecosystems (npm, pip, Docker, etc.), configurable schedules, grouping strategies, and auto-merge compatibility.
Show Me The Code
# .github/dependabot.yml
version: 2
updates:
- package-ecosystem: npm
directory: /
schedule:
interval: weekly
groups:
dev-deps:
dependency-type: development
When You'll Hear This
"Dependabot opened 12 PRs this week — 3 are security patches." / "We group minor updates so Dependabot doesn't flood us with PRs."
Related Terms
Auto-Merge
Auto-Merge is the 'merge it when it's ready' button. Enable it on a PR, and once all checks pass and approvals are in, it merges automatically.
Renovate
Renovate is Dependabot's more powerful cousin.
SCA
SCA checks if the libraries you're using have known vulnerabilities. You didn't write the bug, but you imported it. That lodash version from 2019?
Supply Chain Security
Supply Chain Security protects the entire path from code to production — dependencies, build systems, registries, everything.