Back to updates

Dependabot - 1

2026 (4)

February (3)

github: Track additional Dependabot configuration changes in audit logs

GitHub

2026-02-10

GitHub added two new audit log event types to track additional Dependabot settings changes at the organization and enterprise levels.

github: Dependabot now supports OIDC authentication

GitHub

2026-02-03

GitHub Dependabot can now authenticate to private registries using OpenID Connect (OIDC), removing the need to store long-lived registry credentials as repository secrets for Dependabot update jobs.

github: The Dependabot Proxy is now open source with an MIT license

GitHub

2026-02-03

GitHub has open-sourced the Dependabot Proxy and released it under the permissive MIT license, allowing developers to review the implementation (including how authentication is handled for different package ecosystems), reuse it, and contribute.

January (1)

github: Changes to GitHub Dependabot pull request comment commands

GitHub

2026-01-27

GitHub deprecated and removed several Dependabot-specific pull request comment commands (announced Oct 2025) and replaced them with GitHub's native pull request features; users should migrate any automation or scripts that relied on those commands.

2025 (8)

December (6)

github: You can now require reviews before closing Dependabot alerts with delegated alert dismissal

GitHub

2025-12-19

GitHub announced Delegated alert dismissal, a feature that requires a review process before Dependabot alerts can be closed. It is available to GitHub Code Security customers and was reported on the GitHub Blog (changelog entry dated 2025-12-19).

github: Dependabot version updates now support Julia

GitHub

2025-12-16

GitHub Dependabot's version updates now support Julia projects, allowing automatic updates of Julia dependencies.

github: Dependabot version updates now support Bazel

GitHub

2025-12-16

GitHub announced that Dependabot version updates now support Bazel projects, allowing automatic version updates for dependencies declared with Bzlmod or in WORKSPACE files.

github: Dependabot version updates now support OpenTofu

GitHub

2025-12-16

GitHub announced that Dependabot version updates now support OpenTofu, allowing projects that use OpenTofu to receive automated dependency updates to keep their infrastructure code current.

github: Dependabot security updates now support uv

GitHub

2025-12-16

Dependabot now supports security alerts and automatic dependency updates for the uv ecosystem. When vulnerabilities are found in uv dependencies, Dependabot can open security alerts and create pull requests to update to secure versions.

github: Dependabot-based dependency graphs for Go

GitHub

2025-12-09

GitHub announced Dependabot-based dependency graphs for Go projects to provide more complete and accurate transitive dependency trees, as part of continued supply chain security improvements for package ecosystem support.

November (2)

github: Custom labels configuration option for Dependabot self-hosted and larger GitHub-hosted Actions runners now generally available at the organization level

GitHub

2025-11-25

Dependabot update jobs can now target specific self-hosted and larger GitHub-hosted Actions runners by using custom labels. The feature, previously limited to a single dependabot label, is now generally available at the organization level and provides finer control over where Dependabot runs.

github: Custom labels configuration option for Dependabot self-hosted and larger GitHub-hosted Actions runners now generally available at the organization level

GitHub

2025-11-25

Dependabot update jobs can now target specific self-hosted and larger GitHub-hosted Actions runners by using custom labels. The feature, previously limited to a single dependabot label, is now generally available at the organization level and provides finer control over where Dependabot runs.