Dependabot - 1

2026 (5)

August (1)

github: Customize Dependabot pull request branch names

GitHub

2026-08-04

Dependabot now supports custom pull request branch names through new `pull-request-branch-name` settings in `.github/dependabot.yml`. You can configure a prefix, maximum length, and separators for segments and words.

July (2)

github: Dependabot alerts on malicious packages across more ecosystems

GitHub

2026-07-28

GitHub Advisory Database now ingests malware advisories from OpenSSF’s malicious-packages repository, expanding the malware data available to Dependabot alerts. This broadens coverage across more ecosystems.

github: Dependabot version updates introduce default package cooldown

GitHub

2026-07-14

Dependabot version updates now use a default package cooldown: it will wait at least three days after a new release appears in the registry before opening a version update pull request. This applies to version updates and delays PR creation for recently published releases.

June (2)

github: Dependabot no longer infers .npmrc

GitHub

2026-06-30

Dependabot no longer infers .npmrc settings for npm private registries. Instead of reconstructing .npmrc from lockfile URLs, it will stop trying to guess configuration based on potentially incorrect lockfile data.

github: Upcoming cloud data retention policy for closed security alerts

GitHub

2026-06-30

GitHub will begin enforcing a cloud data retention policy for closed Dependabot security alerts on August 25, 2026. The post says this provides a defined retention period for alert data, but it does not include the exact duration in the excerpt provided.