# Dependabot Published articles for Dependabot. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Tame Dependabot: Group your updates, slow the cadence, keep security fast DevFeed: [Tame Dependabot: Group your updates, slow the cadence, keep security fast]() Original publisher: [Read original article]() Author: Bruno Borges Published: 2026-07-29T16:00:00Z Content type: tutorial Language: en Sources: [GitHub]() Topics: [GitHub](), [pull-requests](), [configuration](), [Open Source]() Tags: [batch](), [build](), [ci](), [configuration](), [dependabot](), [dependencies](), [dependency](), [ecosystem](), [engineering](), [github](), [github-actions](), [logs](), [maintenance](), [open-source](), [pull-request](), [pull-requests](), [review](), [security](), [supply-chain-security]() ### AI overview This tutorial explains how to reduce Dependabot pull request noise by grouping dependency updates into a monthly batch while keeping security updates fast. It uses Microsoft's open source GCToolkit project as an example and describes the relevant configuration changes. ### Source excerpt Dependabot keeps your dependencies current, but its defaults can flood your repository with pull requests. Here's how grouping updates, slowing the cadence, and keeping security fixes fast cut the noise on a Microsoft open source project. The post Tame Dependabot: Group your updates, slow the cadence, keep security fast appeared first on The GitHub Blog. ## Adopt hardened containers without changing your pipelines, tooling, or environment DevFeed: [Adopt hardened containers without changing your pipelines, tooling, or environment]() Original publisher: [Read original article]() Published: 2026-06-24T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [Containers](), [chainguard containers](), [Security](), [Deployment](), [Tooling]() Tags: [chainguard](), [chainguard-containers](), [chainguard-redhat-rpm](), [cmvp](), [compliance](), [containers](), [cyclonedx](), [dependabot](), [deployment](), [fips](), [hardened-containers](), [provenance](), [rhel](), [rhel-10](), [rhel-9](), [rpm-10](), [rpm-9](), [sboms](), [secure-by-default](), [security](), [vulnerabilities]() ### AI overview Chainguard announces updates to Chainguard Containers that support enterprise adoption of hardened images without changing existing pipelines, tooling, or environments. The updates include RPM support for RHEL 9 and RHEL 10, compatible image tags, a CMVP-validated Go Geomys FIPS image, Dependabot support for private registries, and flattened CycloneDX SBOMs for compliance tools. ### Source excerpt Chainguard expands Containers with RPM support, FIPS enhancements, and easier migrations, bringing secure-by-default software to enterprise workflows. ## Using agents as scaffolding for recurring security-vulnerability tasks DevFeed: [Using agents as scaffolding for recurring security-vulnerability tasks]() Original publisher: [Read original article]() Published: 2026-04-12T17:00:00Z Content type: opinion Language: en Sources: [Will Larson - Irrational Exuberance]() Topics: [Agent Framework](), [Vulnerabilities](), [GitHub](), [Dependabot](), [Model Context Protocol](), [Slack]() Tags: [agent-framework](), [agents](), [dependabot](), [github](), [mcp](), [security-vulnerabilities](), [slack]() ### AI overview The article examines using agents to reduce human involvement in recurring software-company processes. It describes an internal workflow that receives GitHub Dependabot webhooks, filters vulnerability alerts, identifies issue owners through GitHub MCP, and sends alerts to Slack, while noting that the agent could not reliably limit notifications to critical-severity alerts. ### Source excerpt One of my gifts/curses is an endless fixation with how processes can be optimized. For a brief moment early in my career, that was focused on improving how humans collaborate, but that quickly switched to figuring out how we can minimize human involvement, and eliminate human-to-human handoffs as much as possible. Lately, every time I perform a recurring task-or see someone else perform one-I think about how we might eliminate the human's involvement entirely by introducing agents. This both has worked well, but also worked poorly, and I wanted to highlight the pattern I've found useful. For a concrete example, a problem that all software companies have is patching security vulnerabilities. We have that problem too, and I check our security dashboards periodically to ensure nothing has gone awry. Sometimes when I check that dashboard, I'll notice a finding that's precariously close to our resolution SLAs, and either fix it myself or track down the appropriate team to fix it. However, this feels like a process that shouldn't require me checking on it. Five to six months ago, I added Github Dependabot webhooks as an input into our internal agent framework. Then I set up an agent to handle those webhooks, including filtering incoming messages down to the highest priority issues. About a month ago, when I upgraded from GPT 4.1 to GPT 5.4 with high reasoning, I noticed that it got quite good at using the Github MCP to determine the appropriate owners for a given issue, using the same variety of techniques that a human would use: looking at Codeowners files where available, looking at recent commits on the repository, and so on. The alerts and owners were already getting piped into a Slack channel. So, this worked! However, it didn't actually work that well, because despite repeated iteration on the prompt, including numerous CRITICAL: you must... statements, it simply could not reliably restrict itself to critical severity alerts. It would also include some high severity ## Turn Dependabot Off DevFeed: [Turn Dependabot Off]() Original publisher: [Read original article]() Author: Filippo Valsorda Published: 2026-02-20T19:48:08Z Content type: opinion Language: en Sources: [Filippo Valsorda]() Topics: [GitHub Actions](), [Go Language](), [Vulnerabilities](), [ci]() Tags: [ci](), [dependabot](), [github-actions](), [go](), [security](), [vulnerabilities](), [vulnerability-scanner]() ### AI overview The article argues that Dependabot creates excessive and often irrelevant security-alert noise in the Go ecosystem. It recommends replacing Dependabot with scheduled GitHub Actions that run govulncheck and tests against the latest dependency versions, and using vulnerability scanners that filter by package and vulnerable-symbol reachability. ### Source excerpt I recommend turning Dependabot off and replacing it with a pair of scheduled GitHub Actions, one running govulncheck, and the other running CI against the latest version of your dependencies. ## Running Renovate as a GitHub Action (and NO PAT!) DevFeed: [Running Renovate as a GitHub Action (and NO PAT!)]() Original publisher: [Read original article]() Published: 2026-01-19T00:00:00Z Content type: tutorial Language: en Sources: [Chainguard: Unchained]() Topics: [renovate](), [GitHub Actions](), [octo sts](), [github personal access token](), [Security](), [maintenance]() Tags: [chainguard-containers](), [chainguard-images](), [dependabot](), [dependencies](), [github](), [github-action](), [github-pat-alternative](), [guide](), [maintenance](), [octo-sts](), [personal-access-token](), [renovate](), [run](), [security](), [software-supply-chain-security]() ### AI overview This tutorial explains how to run Renovate as a scheduled GitHub Action to update repository dependencies without using a long-lived GitHub Personal Access Token. It presents Octo STS as the replacement for the PAT and outlines the workflow setup. ### Source excerpt Discover how you can run Renovate as a GitHub Action without needing a GitHub Personal Access Token by using Octo STS. ## Pinning GitHub Actions DevFeed: [Pinning GitHub Actions]() Original publisher: [Read original article]() Author: Carlos Alexandro Becker Published: 2025-11-17T00:00:00Z Content type: tutorial Language: en Sources: [Carlos Becker]() Topics: [GitHub Actions](), [Security](), [supply chain attacks](), [CI/CD](), [Dependabot]() Tags: [also](), [ci-cd](), [commit](), [dependabot](), [github-actions](), [security](), [supply-chain-attacks](), [workflow]() ### AI overview This tutorial explains why GitHub Actions should be pinned to full commit SHAs instead of mutable tags or branches. It describes the security and auditability benefits and introduces caarlos0/pinata, a tool that automates pinning and creates pull requests for review. ### Source excerpt If you're using GitHub Actions in your projects, you should be pinning your actions to specific commit SHAs instead of using tags or branches. ## Automatically merge dependabot pull requests DevFeed: [Automatically merge dependabot pull requests]() Original publisher: [Read original article]() Author: Carlos Alexandro Becker Published: 2024-12-11T00:00:00Z Content type: tutorial Language: en Sources: [Carlos Becker]() Topics: [GitHub Actions](), [Dependabot](), [Automation](), [pull-requests](), [GitHub]() Tags: [automation](), [dependabot](), [github](), [github-actions](), [pull-requests](), [repositories]() ### AI overview The article describes an automation that approves and merges Dependabot pull requests after a successful build. It requires enabling the GitHub Actions permission to create and approve pull requests in each repository. ### Source excerpt A couple of weeks ago I added a small automation to automatically merge dependabot pull requests if the build succeed. ## Gradle partners with GitHub on supply chain security DevFeed: [Gradle partners with GitHub on supply chain security]() Original publisher: [Read original article]() Author: Gradle Build Tool Published: 2024-04-18T04:00:00Z Content type: news Language: en Sources: [The Gradle Blog]() Topics: [Gradle](), [GitHub](), [supply-chain-security](), [Dependency management](), [Security](), [Developer experience]() Tags: [dependabot](), [dependencies](), [dependency-management](), [github](), [github-action](), [gradle](), [integrity](), [security](), [supply-chain-security]() ### AI overview Gradle and GitHub announce a technical partnership focused initially on software supply chain security and developer experience. The first feature is a Gradle dependency submission GitHub Action that automatically sends project dependencies to GitHub's dependency graph, helping users understand dependencies and receive Dependabot alerts. ### Source excerpt Gradle is happy to announce a technical partnership with GitHub focusing on multiple areas, starting with supply chain security and developer experience. With this partnership, we establish a direct connection between organizations and plan to cooperate on integrations between GitHub and Gradle to promote best security practices among Gradle users. The first feature being released as a part of this partnership is the dependency submission GitHub Action for Gradle, which can be configured to automatically submit dependencies to GitHub's dependency graph, helping users better understand their application and receive Dependabot alerts. This partnership will improve the experience of many users within the shared Gradle and GitHub ecosystem. GitHub is the world's leading AI-powered developer platform to build, scale, and deliver secure software, home to more than 284 million public repositories. Gradle Build Tool is the default build system for Android application development, the most used JVM build system on GitHub, and among the most used build systems on the GitHub platform across public and private repositories. "Gradle is one of the most used build tools among GitHub users, and we're excited to continue to collaborate with them to improve supply chain security for the Gradle community. These updates to the Gradle Build Action will help millions of GitHub users improve the security of their apps by giving them better insights into their dependencies." - Jon Janego, Senior Product Manager at GitHub The problem with vulnerable dependencies Vulnerable project dependencies are a major risk for the software ecosystem. It's critical for developers to quickly detect potential vulnerabilities arising from both direct and transitive dependencies. It is a priority for many modern build systems, including Gradle, to help developers manage their dependencies and protect the supply chain and end users. Gradle Build Tool provides advanced security features like dependency verific ## Streamline dependency updates with Mergify and Snyk DevFeed: [Streamline dependency updates with Mergify and Snyk]() Original publisher: [Read original article]() Author: Liran Tal Published: 2023-08-23T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Dependency management](), [Automation](), [GitHub](), [pull-requests](), [ci](), [Code review](), [Security](), [vulnerability scanning](), [snyk](), [snyk-open-source]() Tags: [acquisition](), [application-security](), [automation](), [blog](), [ci](), [code-review](), [dependabot](), [dependency](), [developer](), [devops](), [devrel](), [github](), [open-source-security](), [security](), [snyk-open-source](), [vulnerability-scanning]() ### AI overview This article explains how Mergify and Snyk can automate dependency update workflows. Snyk identifies dependency updates and creates GitHub pull requests, while Mergify can automate pull request review and merging based on defined conditions, helping teams keep dependencies current and address security fixes with less manual work. ### Source excerpt Automate dependency updates with Mergify and Snyk. ## Tips and tricks for using Renovate DevFeed: [Tips and tricks for using Renovate]() Original publisher: [Read original article]() Author: Harsh Shandilya Published: 2023-01-17T19:32:18Z Content type: tutorial Language: en Sources: [Posts on Harsh Shandilya]() Topics: [renovate](), [configuration](), [Dependabot](), [ci](), [GitHub Actions](), [Regular expression](), [Hugo](), [JavaScript](), [Netlify]() Tags: [config](), [configuration](), [dependabot](), [dependencies](), [dependency-management](), [github](), [github-actions](), [hugo](), [netlify](), [regex](), [renovate](), [tips]() ### AI overview A practical guide to using Renovate for dependency management. It covers disabling updates for selected packages, grouping related updates, setting semver bounds, detecting dependencies in non-standard declarations with regular expressions, securing GitHub Actions with exact commit SHAs, and automatically merging compatible updates. ### Source excerpt Renovate is an extremely powerful tool for keeping your dependencies up-to-date, and its flexibility is often left unexplored. I'm hoping to change that