Git & GitHub
/Intermediate
Dependabot
Definition
An automated bot integrated into GitHub that scans your repository for outdated or insecure dependencies (packages) and automatically opens Pull Requests to update them.
Explain Like I'm New
A free security guard for your project. If you are using React 17, and a massive security flaw is discovered in it, Dependabot will email you, open a Pull Request, update your `package.json` to React 18, and wait for you to click Merge.
Real World Example
Waking up to 5 automated Pull Requests from Dependabot keeping all your tiny Node.js libraries perfectly up to date so you don't have to check them manually.
Common Use Cases
- •Automated security patching
- •Package maintenance
Terminal Output
bash / terminal
/*
You can configure Dependabot by creating a file at:
.github/dependabot.yml
*/
version: 2
updates:
# Scan npm packages (package.json)
- package-ecosystem: "npm"
# Look in the root directory
directory: "/"
# Check for updates once a week
schedule:
interval: "weekly"
Interview Questions
basic
- Is Dependabot a human or a robot?
intermediate
- If Dependabot opens a PR to update a library, should you just blindly merge it?