Dependabot
Free dependency updates and vulnerability alerts, built into GitHub.
What it is
Dependabot monitors your manifests for outdated and vulnerable dependencies and opens pull requests to update them, with grouped updates and configurable schedules. It is free on every GitHub repository, public or private, which makes it the default baseline for dependency hygiene.
Best for
Where it is strong
- Free and requires a single config file to enable.
- Version-bump pull requests mean remediation is a review, not a task.
- Grouped updates keep the PR volume manageable.
Where it falls short
- No reachability analysis, so it reports vulnerabilities in code you never call.
- PR noise is a genuine problem on large dependency trees without grouping configured.
- GitHub only.
Pricing
Free
FreeFree tier: Free on all GitHub repositories including private ones.
What drives the bill: Completely free. Advanced Security features such as code scanning are separately licensed.
Check current pricing on GitHub (Microsoft)’s siteFigures are indicative and were last reviewed August 2026. Vendors change pricing often; confirm before you commit.
Works with
What people who use Dependabot say
No reviews of Dependabot yet. If you have used it in anger, yours would be the first.
Alternatives to Dependabot
If Dependabot is not the right fit, these solve the same problem differently.
Snyk
Security Testing
Developer-first security across dependencies, code, containers and infrastructure.
Renovate
Security Testing
Highly configurable automated dependency updates, free and self-hostable.
Mend.io
Security Testing
Software composition analysis with automated remediation and licence compliance.