Dependabot for licensing, vulnerabilities and versioning
Automate analysis of open-source components with Dependabot
Three distinct features, and confusing them is the reliable exam trap.
| Feature | Does | Trigger |
|---|---|---|
| Dependabot alerts | Tells you a dependency has a known vulnerability | A new advisory affects a dependency you use |
| Dependabot security updates | Raises a pull request to move to a fixed version | An alert exists with a patched version available |
| Dependabot version updates | Keeps dependencies current regardless of vulnerabilities | The schedule in dependabot.yml |
The distinction in one line: alerts inform, security updates fix vulnerabilities, version updates fix staleness.
Configuration
Version updates are configured in .github/dependabot.yml:
version: 2
updates:
- package-ecosystem: "npm"
directory: "/"
schedule:
interval: "weekly"
open-pull-requests-limit: 5Alerts and security updates are enabled at repository or organisation level rather than in this file — which is why "we added dependabot.yml, why are we not getting security alerts?" is a common confusion.
Licensing
Dependency review surfaces the licence of dependencies a pull request introduces, so a non-compliant licence can be caught at the point of introduction rather than in an audit months later. Combined with an Azure Artifacts feed's saved upstream packages, you get both the record of what was consumed and the gate at the moment of consumption.
Why version updates matter for security
Staying current is not merely hygiene: a project several major versions behind often cannot take a security patch without a migration, so the vulnerability stays open for weeks. Version updates keep the upgrade path short enough that security updates are actually mergeable.
Primary sources