Thiago Teixeira
EN | PT

Dependabot

GitHub

Automated dependency updates and vulnerability alerts, native to GitHub.

Application & Supply Chain Freemium Platform / Suite Learning saas
Homepage Docs

Cyber Kill Chain & Defender Lifecycle

Attacker — Kill Chain
1 Reconnaissance
2 Weaponization
3 Delivery
4 Exploitation
5 Installation
6 Command & Control
7 Actions on Objectives
Defender — IR Lifecycle
8 Preparation
9 Detection & Analysis
10 Containment, Eradication & Recovery
11 Post-Incident Activity

Description

Dependabot watches a repository's manifests and opens pull requests when a dependency is outdated or has a published advisory. Being built into GitHub is the point: the update arrives as a reviewable PR with a changelog and the CI result attached, rather than as a task nobody schedules.

The control it provides is time to patch, which is what an auditor asks about for OWASP A06 — not whether you scan, but how long a known vulnerable version stays in production.

Use cases

  • Continuous dependency patching without manual triage
  • Vulnerability alerts on a repository you do not check daily
  • Evidence of a patch cadence for a compliance review

Example

# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: "pip"
    directory: "/"
    schedule:
      interval: "weekly"