← All notes

Answer: Dependabot security updates are automated pull requests that help you update dependencies with known vulnerabilities. Dependabot version updates are automated pull requests that keep your dependencies updated, even when they don't have any vulnerabilities. (S1)

Security updates

• If you enable Dependabot security updates, when a Dependabot alert is raised for a vulnerable dependency in the dependency graph of your repository, Dependabot automatically tries to fix it. (S1)
• Dependabot signs its own commits by default, even if commit signing is not a requirement for the repository. (S1)
• Dependabot security updates can fix vulnerable dependencies in GitHub Actions, raising a pull request to update vulnerable actions used in your workflows to the minimum patched version. (S1)
• Pull requests opened by Dependabot can trigger workflows that run actions. (S1)

Version updates

• You enable Dependabot version updates by checking a dependabot.yml configuration file into your repository. (S2)
• The dependabot.yml file can also be configured to tell Dependabot how to maintain your dependencies. (S2)
• Dependabot also checks workflow files for uses of reusable workflows, and updates the Git reference for these called reusable workflows. (S2)
• When maintainers of a repository stop interacting with Dependabot pull requests, Dependabot temporarily pauses its updates and lets you know. (S2)

Claims

• id: C1 claim: Security updates are automated pull requests for dependencies with known vulnerabilities. source: S1 evidence: "Dependabot security updates are automated pull requests that help you update dependencies with known vulnerabilities."
• id: C2 claim: Dependabot signs its own commits by default. source: S1 evidence: "Dependabot signs its own commits by default"
• id: C3 claim: Version updates are enabled by checking in a dependabot.yml file. source: S2 evidence: "You enable Dependabot version updates by checking a dependabot.yml configuration file into your repository."
• id: C4 claim: Dependabot pauses updates when maintainers stop interacting with its pull requests. source: S2 evidence: "Dependabot temporarily pauses its updates and lets you know"

Sources

• [S1] Dependabot security updates - GitHub Docs. GitHub Docs. https://docs.github.com/en/code-security/dependabot/dependabot-security-updates/about-dependabot-security-updates . License: CC BY 4.0 (github/docs). Accessed 2026-11-04.
• [S2] Dependabot version updates - GitHub Docs. GitHub Docs. https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/about-dependabot-version-updates . License: CC BY 4.0 (github/docs). Accessed 2026-11-04.

License: this note is CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Summary by iinventedlight (AI-assisted).

@misc{iil_note_rbkemez2,
  author = {{iinventedlight}},
  title = {{Dependabot: security updates versus version updates}},
  howpublished = {iinventedlight Library},
  year = {2026},
  date = {2026-11-04},
  url = {https://iinventedlight.com/library/notes/github-dependabot/},
  note = {Permanent ID iil:note:rbkemez2. License: CC-BY-4.0.},
}

Markdown

Spotted a mistake? Use the MCP feedback tool or email hello@iinventedlight.com.

For language models and agents: start at /llms.txt. This page in Markdown: /library/notes/github-dependabot.md.