dependabot

Dependabot version updates now proactively updates Docker image tags in Kubernetes manifests.

When specifying the Docker ecosystem in dependabot.yml include an entry for each directory where a Kubernetes manifest which references Docker image tags is located. Kubernetes manifests can be either Kubernetes Deployment YAML files or Helm charts. Dependabot will parse the unrendered version of the manifest in order to keep your Docker image tags updated.

Learn more about configuring Dependabot version updates.

Dependabot is a friendly co-developer supporting millions of repositories, but previously wasn't included in mention suggestions.

Starting today, you can more easily mention Dependabot, thanks to autocomplete.

Dependabot helps you keep your dependencies up-to-date with Dependabot version updates. These pull requests are configured via a dependabot.yml file.

Starting today, if you fork a repository with an existing dependabot.yml, Version updates will be disabled by default. To enable Dependabot pull requests based on this configuration, you can click “enable” from your forked repository’s “Code security and analysis” settings page.

After enabling Dependabot version updates, you will also be able to disable with a single click from this settings page.

Learn more about configuring Dependabot version updates.

Removing the security vulnerability banner

The yellow banner stating "We found potential security vulnerabilities in your dependencies" is being removed. Please use the "Security" alert count in your repository navigation as an indicator for when your repository has Dependabot alerts. You can also adjust your notifications settings to opt-in to email and web notifications, as well as email digests for your Dependabot alerts.

About this change

We've been working to steadily improve our security alert notifications and indicators. As part of our notifications strategy, we are removing this legacy banner.

Available alert notifications and indicators

Today, when Dependabot detects a dependency-based vulnerability, Dependabot lets you know based on your user notifications settings and repository watching settings. You can opt to receive:

• Web-based notifications on alerts in your GitHub inbox
• Email based notifications on alerts
• Email digests (weekly or daily roll-ups of alerts).

From the UI, you can also use the "Security" alert count in your repository navigation as an indicator for when your repository has alerts. This Security tab includes the count for all active Dependabot alerts, code scanning alerts, secret scanning alerts, and any security advisories that you have permissions to view.

Learn more about GitHub Advanced Security, Dependabot alerts, and configuring notifications for alerts.

Dependabot now supports updates to Python dependencies for pyproject.toml files that follow the PEP 621 standard for our supported Python package managers.

Learn more about Dependabot's supported ecosystems and package managers.

Dependabot now supports now supports the increase-if-necessary versioning strategy for the Python ecosystem.

This allows you to reduce Dependabot version updates when your current dependency requirement is already satisfied by a new version.

Learn more about configuring versioning strategies in your dependabot.yml file.

Dependabot has added support for updating dependencies in Yarn v2 and Yarn v3 manifests (package.json, and yarn.lock files). This is in addition to the existing support for Yarn v1. There is no action required for existing repositories where Dependabot security updates is enabled, however, if you would like to receive proactive updates with Dependabot version updates, you should add configuration for the npm ecosystem to your dependabot.yml file.

For more information:

• Configuring Dependabot version updates
• Dependabot supported ecosystems and package managers

We’ve been responding to your feedback – here’s a recap of some changes recently made to Dependabot alerts.

• Dependabot Alerts details pages now auto-magically refresh after PR generation attempts are completed, rather than spinning forever
• Alerts are more accurately mapped to Dependabot pull requests
• Labels in the Dependabot Alerts row page now act as filters
• You can now suggest improvements to an advisory directly from the alert details page (shown below).

Let us know of other improvements you’d like to see in our GitHub community discussion page.

When resolving security alerts for vulnerable transitive npm dependencies, it is possible that updating a direct dependency will remove the vulnerable transitive dependency from the tree. Dependabot can now resolve these security alerts by creating a pull request that removes the unnecessary transitive dependency.

You can now programmatically view and act on Dependabot alerts via the REST API. New endpoints to view, list, and update Dependabot alerts are available in a public beta.

For more information, see Dependabot alerts in the REST API reference or learn more about Dependabot alerts in our documentation.