Quick Notes107 words
Dependabot for licensing, vulnerabilities and versioning — quick notes
Dependabot — quick notes
| Feature | Does |
|---|---|
| Alerts | Tells you about a vulnerable dependency |
| Security updates | Raises a PR to a fixed version |
| Version updates | Keeps dependencies current regardless of vulnerabilities |
- Version updates configured in
.github/dependabot.yml. - Alerts and security updates are enabled at repository/organisation level, not in that file.
- Dependency review surfaces licences of dependencies a PR introduces.
One line: alerts inform · security updates fix vulnerabilities · version updates fix staleness.
Why staying current is security: several majors behind means a patch needs a migration, so the vulnerability stays open.