Dependabot - 2

2025 (8)

December (1)

github: Dependabot-based dependency graphs for Go

GitHub

2025-12-09

GitHub announced Dependabot-based dependency graphs for Go projects to provide more complete and accurate transitive dependency trees, as part of continued supply chain security improvements for package ecosystem support.

November (2)

github: Custom labels configuration option for Dependabot self-hosted and larger GitHub-hosted Actions runners now generally available at the organization level

GitHub

2025-11-25

Dependabot update jobs can now target specific self-hosted and larger GitHub-hosted Actions runners by using custom labels. The feature, previously limited to a single dependabot label, is now generally available at the organization level and provides finer control over where Dependabot runs.

github: Custom labels configuration option for Dependabot self-hosted and larger GitHub-hosted Actions runners now generally available at the organization level

GitHub

2025-11-25

October (2)

github: Dependabot alerts API offset-based pagination parameters deprecated

GitHub

2025-10-14

GitHub has removed offset-based pagination parameters (page, first, last) from all Dependabot alerts REST API endpoints; only cursor-based parameters (before, after, per_page) are supported going forward.

github: Upcoming changes to GitHub Dependabot pull request comment commands

GitHub

2025-10-07

On November 11, 2025, GitHub will deprecate several Dependabot-specific pull request comment commands and rely on GitHub’s native pull request features instead; users should update any workflows or automations that depend on those comment commands.

September (3)

github: Conda ecosystem support for Dependabot now generally available

GitHub

2025-09-16

GitHub Dependabot now supports parsing and updating Conda environment.yml files, providing both security and version updates for Conda-based Python projects; the feature is generally available.

github: Dependabot alerts now support production context prioritization in public preview

GitHub

2025-09-10

GitHub Dependabot alerts can now use production context from external artifact registries (for example, JFrog Artifactory) and CI/CD workflows to filter and prioritize alerts. The capability is available as a public preview, letting teams focus remediation on vulnerabilities that affect production artifacts and deployments.

github: Go private registry support for Dependabot now generally available

GitHub

2025-09-09

Dependabot is now generally available for Go private registries: it can update private Go modules hosted on enterprise registries and behind GOPROXY-compatible private proxies, alongside public modules in the same workflow, enabling automated version and dependency updates for private Go code.