Dependabot - 1

2026 (7)

March (2)

github: Dependabot now detects malware in npm dependencies

GitHub

2026-03-17

Dependabot can now alert on npm dependencies that match known malware advisories. When malware alerting is enabled, it checks repository npm dependencies against malicious package versions.

github: Dependabot alert assignees are now generally available

GitHub

2026-03-03

GitHub Dependabot now supports assigning vulnerability alerts to specific users (generally available). This adds per-alert ownership to help teams track and remediate dependency vulnerabilities.

February (4)

github: Dependabot can group updates by dependency name across multiple directories

GitHub

2026-02-24

Dependabot can now group update PRs by dependency name across multiple directories in a repository.

github: Track additional Dependabot configuration changes in audit logs

GitHub

2026-02-10

GitHub added two new audit log event types to track additional Dependabot settings changes at the organization and enterprise levels.

github: Dependabot now supports OIDC authentication

GitHub

2026-02-03

GitHub Dependabot can now authenticate to private registries using OpenID Connect (OIDC), removing the need to store long-lived registry credentials as repository secrets for Dependabot update jobs.

github: The Dependabot Proxy is now open source with an MIT license

GitHub

2026-02-03

GitHub has open-sourced the Dependabot Proxy and released it under the permissive MIT license, allowing developers to review the implementation (including how authentication is handled for different package ecosystems), reuse it, and contribute.

January (1)

github: Changes to GitHub Dependabot pull request comment commands

GitHub

2026-01-27

GitHub deprecated and removed several Dependabot-specific pull request comment commands (announced Oct 2025) and replaced them with GitHub's native pull request features; users should migrate any automation or scripts that relied on those commands.

2025 (5)

December (5)

github: You can now require reviews before closing Dependabot alerts with delegated alert dismissal

GitHub

2025-12-19

GitHub announced Delegated alert dismissal, a feature that requires a review process before Dependabot alerts can be closed. It is available to GitHub Code Security customers and was reported on the GitHub Blog (changelog entry dated 2025-12-19).

github: Dependabot version updates now support Julia

GitHub

2025-12-16

GitHub Dependabot's version updates now support Julia projects, allowing automatic updates of Julia dependencies.

github: Dependabot version updates now support Bazel

GitHub

2025-12-16

GitHub announced that Dependabot version updates now support Bazel projects, allowing automatic version updates for dependencies declared with Bzlmod or in WORKSPACE files.

github: Dependabot version updates now support OpenTofu

GitHub

2025-12-16

GitHub announced that Dependabot version updates now support OpenTofu, allowing projects that use OpenTofu to receive automated dependency updates to keep their infrastructure code current.

github: Dependabot security updates now support uv

GitHub

2025-12-16

Dependabot now supports security alerts and automatic dependency updates for the uv ecosystem. When vulnerabilities are found in uv dependencies, Dependabot can open security alerts and create pull requests to update to secure versions.