Dependabot - 1

2026 (10)

May (1)

github: Cross-org Dependabot access for internal repositories

GitHub

2026-05-11

Dependabot can now access internal repositories in other organizations within the same enterprise. This lets Dependabot resolve dependencies hosted in cross-org internal GitHub repositories.

April (5)

github: Dependabot-based dependency graphs for Python

GitHub

2026-04-23

GitHub now uses Dependabot-based data to generate more complete and accurate transitive dependency trees for Python dependency graphs and SBOMs. This change improves coverage for Python projects.

github: OIDC support for Dependabot and code scanning

GitHub

2026-04-14

Dependabot and code scanning now support OpenID Connect (OIDC) authentication for private registries configured at the organization level. This removes the need to store long-lived credentials as repository secrets.

github: Dependabot and code scanning: Org-level private registries

GitHub

2026-04-14

GitHub now lets organizations configure multiple private registries at the org level for Dependabot and code scanning, which is useful for setups that use more than one internal package feed. Previously, org-level settings supported only one private registry per ecosystem.

github: Dependabot alerts are now assignable to AI agents for remediation

GitHub

2026-04-07

Dependabot alerts can now be assigned to AI coding agents for remediation, including Copilot, Claude, and Codex. This is intended for vulnerabilities that require code changes beyond a simple dependency version update.

github: Dependabot version updates now support the Nix ecosystem

GitHub

2026-04-07

Dependabot version updates now support the Nix ecosystem via Nix flakes. You can add `nix` as a package ecosystem in `dependabot.yml` and Dependabot will monitor `flake.lock` inputs and open pull requests when updates are available.

March (3)

github: Dependabot now supports Xcode projects using SwiftPM with .xcodeproj manifests

GitHub

2026-03-31

Dependabot now supports Swift package dependencies in Xcode projects that use .xcodeproj bundles to manage packages, even when there is no Package.swift file. It can detect and update those dependencies directly from the Xcode project manifest.

github: Dependabot now detects malware in npm dependencies

GitHub

2026-03-17

Dependabot can now alert on npm dependencies that match known malware advisories. When malware alerting is enabled, it checks repository npm dependencies against malicious package versions.

github: Dependabot alert assignees are now generally available

GitHub

2026-03-03

GitHub Dependabot now supports assigning vulnerability alerts to specific users (generally available). This adds per-alert ownership to help teams track and remediate dependency vulnerabilities.

February (1)

github: Dependabot can group updates by dependency name across multiple directories

GitHub

2026-02-24

Dependabot can now group update PRs by dependency name across multiple directories in a repository.