---
source: https://iinventedlight.com/library/notes/github-dependabot.md
title: "Dependabot: security updates versus version updates"
license: CC-BY-4.0
license_url: https://creativecommons.org/licenses/by/4.0/
source_license: "CC BY 4.0 (github/docs); prose restates or closely paraphrases cited source lines"
license_family: github-docs-ccby
rule_check: "needs rule check (family not in auto-publish rule; check.mjs auto-approves only usgov and arxiv-ccby)"
attribution: "Summary by iinventedlight (AI-assisted). Sources: GitHub Docs, Dependabot security updates - GitHub Docs, CC BY 4.0 (github/docs); GitHub Docs, Dependabot version updates - GitHub Docs, CC BY 4.0 (github/docs)."
author: "iinventedlight (synthesis of cited sources); text drafted with AI assistance"
date: 2026-11-04
status: published
checked_on: 2026-11-04
as_of: 2026-11-04
confidence: medium
untested: "No code was run for this note; only the fetched documentation pages were read."
category: coding-references
topic_area: "code-ai-eng: GitHub"
tags: ['github', 'dependabot', 'dependencies']
sources:
  - id: S1
    title: "Dependabot security updates - GitHub Docs"
    publisher: GitHub Docs
    url: https://docs.github.com/en/code-security/dependabot/dependabot-security-updates/about-dependabot-security-updates
    accessed: 2026-11-04
    license: "CC BY 4.0 (github/docs)"
  - id: S2
    title: "Dependabot version updates - GitHub Docs"
    publisher: GitHub Docs
    url: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/about-dependabot-version-updates
    accessed: 2026-11-04
    license: "CC BY 4.0 (github/docs)"
---
# Dependabot: security updates versus version updates

**Answer:** Dependabot security updates are automated pull requests that help you update dependencies with known vulnerabilities. Dependabot version updates are automated pull requests that keep your dependencies updated, even when they don't have any vulnerabilities. (S1)

## Security updates

- If you enable Dependabot security updates, when a Dependabot alert is raised for a vulnerable dependency in the dependency graph of your repository, Dependabot automatically tries to fix it. (S1)
- Dependabot signs its own commits by default, even if commit signing is not a requirement for the repository. (S1)
- Dependabot security updates can fix vulnerable dependencies in GitHub Actions, raising a pull request to update vulnerable actions used in your workflows to the minimum patched version. (S1)
- Pull requests opened by Dependabot can trigger workflows that run actions. (S1)

## Version updates

- You enable Dependabot version updates by checking a dependabot.yml configuration file into your repository. (S2)
- The dependabot.yml file can also be configured to tell Dependabot how to maintain your dependencies. (S2)
- Dependabot also checks workflow files for uses of reusable workflows, and updates the Git reference for these called reusable workflows. (S2)
- When maintainers of a repository stop interacting with Dependabot pull requests, Dependabot temporarily pauses its updates and lets you know. (S2)

## Claims
- id: C1
  claim: Security updates are automated pull requests for dependencies with known vulnerabilities.
  source: S1
  evidence: "Dependabot security updates are automated pull requests that help you update dependencies with known vulnerabilities."
- id: C2
  claim: Dependabot signs its own commits by default.
  source: S1
  evidence: "Dependabot signs its own commits by default"
- id: C3
  claim: Version updates are enabled by checking in a dependabot.yml file.
  source: S2
  evidence: "You enable Dependabot version updates by checking a dependabot.yml configuration file into your repository."
- id: C4
  claim: Dependabot pauses updates when maintainers stop interacting with its pull requests.
  source: S2
  evidence: "Dependabot temporarily pauses its updates and lets you know"

## Sources
- [S1] Dependabot security updates - GitHub Docs. GitHub Docs. https://docs.github.com/en/code-security/dependabot/dependabot-security-updates/about-dependabot-security-updates . License: CC BY 4.0 (github/docs). Accessed 2026-11-04.
- [S2] Dependabot version updates - GitHub Docs. GitHub Docs. https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/about-dependabot-version-updates . License: CC BY 4.0 (github/docs). Accessed 2026-11-04.

License: this note is CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Summary by iinventedlight (AI-assisted).