dependabot/dependabot-core
Dependabot Core
dependabot-core is the automated dependency management engine that powers multi-ecosystem package updates and vulnerability remediation. It parses package manifests and lockfiles, polls package registries for newer versions, resolves version constraints across entire dependency trees, and generates pull requests with changelogs and structured descriptions. The system integrates vulnerability database matching to detect known security flaws and can automatically create remediation pull requests.
What distinguishes this project is its handling of complex multi-ecosystem resolution across dozens of package managers, its credential proxy for private registry authentication that never exposes secrets to update logic, and its ability to verify transitive dependency compatibility before proposing an update. The update workflow is highly configurable: users can define versioning strategies, grouping rules to batch related updates into fewer pull requests, exclusion patterns, and per-ecosystem limits. Security updates can be consolidated by ecosystem to reduce pull request volume.
Beyond core update automation, the platform provides monitoring and observability capabilities including compatibility scores derived from public CI results, activity status dashboards, and software bill of materials export. Its API enables programmatic alert assignment management and dependency relationship exploration. Configuration options cover pull request customization, security consolidation, and update strategy control.
This repository provides the core library that underpins GitHub's dependency update service, with the full feature surface documented through its API and configuration schema.
Features
- Automated Dependency Updaters - Automates scanning of package manifests and generating pull requests to update dependencies across multiple ecosystems.
- Lockfile Reconciliation - Updates manifest files and lockfiles to reflect new dependency versions while preserving resolvability.
- Multi-Ecosystem Package Wrappers - Supports numerous package manager formats (npm, pip, Bundler, Maven, etc.) and handles version resolution and lockfile updates.
- Dependency Update Batches - Groups dependency updates into fewer pull requests using user-defined rules and patterns.
- Update Workflow Orchestration - Orchestrates automated dependency updates with configurable versioning strategies, grouping rules, and pull request metadata.
- Multi-Ecosystem Orchestrators - Coordinates dependency updates across multiple programming language ecosystems using ecosystem-specific resolvers.
- Credential Managers - Securely stores and provides credentials for accessing private registries during dependency resolution without exposing secrets.
- Credential Proxies - Provides a credential proxy that enables secure resolution of private packages without exposing secrets.
- Registry Authentication - Provides credentials to private registries via a credential proxy so updates can resolve and update private packages.
- Automated Update Pull Requests - Automates creation of pull requests with changelogs and structured descriptions for each dependency update.
- Repository Manifest Parsing - Parses package manifests and lockfiles to enumerate dependencies and current versions.
- Vulnerability Fix PR Generators - The tool generates a draft pull request with a proposed fix when a security alert triggers automated remediation.
- Minimum Secure Versioning - Opens pull requests to update vulnerable dependencies to the minimum secure version.
- Dependency Analysis - Parses manifest and lock files to list all dependencies with versions, licenses, and vulnerability status.
- Vulnerability Auto-Remediation - Detects dependencies with known vulnerabilities and automatically creates pull requests to patch them to safe versions.
- Dependency Vulnerability Scanners - Scans repository dependencies for known security vulnerabilities and sends alerts on vulnerability detection.
- Credential Injection Proxies - Routes authentication through a proxy to prevent credential exposure during dependency resolution.
- Vulnerability Matching - Compares dependency versions against curated vulnerability databases to detect known security flaws.
- Update Grouping Engines - Combines related dependency updates into fewer pull requests using grouping rules to reduce PR volume.
- Automated Pull Request Reviewers - Checks pull requests for new or updated dependencies and flags known vulnerabilities.
- PR Description Generation - Generates pull request descriptions that summarize changelogs, release notes, and commits for each dependency update.
- Transitive Dependency Compatibility Checks - Verifies that updating a dependency does not break constraints for all transitive dependencies in the tree.
- Package Ecosystem Monitors - Scans directories for supported package manager manifests and checks for new versions on a schedule.
- Supply Chain Security - Detects insecure packages and automatically creates pull requests to update to secure versions, reducing vulnerability exposure.
- Resolvable Version Verifiers - Finds the newest dependency version compatible with all other project dependencies.
- Registry Version Polling - Fetches latest package versions from registries on a configurable schedule to detect available updates.
- Update Exclusions - Suppresses update pull requests for selected packages using configurable ignore patterns and exclusion rules.
- Software Bill of Materials Generators - Generates machine-readable inventories of project dependencies for audit and compliance.
- Dependency Management - Automates dependency updates and security patching.
