Dependabot: security updates vs version updates, and auto-triage
Verdict: Security updates open pull requests automatically only for known vulnerabilities and need no configuration. Version updates run on a schedule set in dependabot.yml to keep dependencies current regardless of vulnerabilities. Custom auto-triage rules dismiss alerts by defined conditions.
| Criterion | Security updates | Version updates |
|---|---|---|
| Trigger | A known vulnerability advisory | A configured schedule |
| Configuration | Automatic; no config file needed | Required in dependabot.yml |
| Goal | Patch vulnerable dependencies to a safe version | Keep dependencies fresh to the latest matching version |
| Prerequisite | Dependency graph and Dependabot alerts enabled | Dependency graph and Dependabot alerts enabled |
| Use when | You want only actionable vulnerability fixes | You want routine freshness bumps |
Rules
- Security updates are vulnerability-driven and automatic; version updates are schedule-driven and configured in dependabot.yml.
- Version updates require configuration and update to the latest matching version; security updates need no configuration.
- Grouped security updates require the dependency graph and Dependabot alerts enabled first.
- Custom auto-triage rules automatically handle Dependabot alerts by conditions such as severity or dependency scope.
- Fine-grained grouping of update pull requests is configured in dependabot.yml by package name, dependency type or SemVer level.
Traps
- Version updates fire on a schedule regardless of vulnerabilities; they do not require an advisory.
- The dependency graph alone does not open pull requests for vulnerable dependencies.
- Auto-triage rules manage Dependabot alerts; they are not a secret scanning bypass control.