A friendly @GitHub-native robot that helps you keep your dependencies up to date
Joined May 2017
- Tweets1K
- Following49
- Followers1.9K
- Likes1K
Dependabot retweeted
Behind the scenes with @ahpook and @dependabot today at the @ch9 studios.
It's all about supply chain security.
@github #developer #security
Dependabot retweeted
Took us a minute, but stacked PRs are now on GitHub 🥞
github.blog/changelog/2026-0…
Dependabot retweeted
Dependabot alerts now cover more ecosystems by ingesting malware advisories from the OpenSSF malicious-packages repository.
• Expanded malware data includes npm, PyPI, and more ecosystems
github.blog/changelog/2026-0…
Dependabot retweeted
4. Enable Dependabot and dependency review
Your project includes code from every package it depends on.
Dependabot alerts you to known vulnerabilities. Dependency review shows what a pull request adds or upgrades and whether those changes introduce vulnerable dependencies.
Dependabot retweeted
Great to see our friends at Dependabot embracing the on-by-default minimum release age/cooldown functionality!
Stay cool 😎 github.blog/changelog/2026-0…
You can read more about why Dependabot now waits three days before issuing version update pull requests, and how that short wait can help keep malicious releases out of your code. In other words, why cooldowns are...cool github.blog/security/supply-…
Stay cool 😎 github.blog/changelog/2026-0…
tl;dr in 60 days, alerts closed 2 or more years ago are moving to archival storage. you will still be able to download them if you need them. github.blog/changelog/2026-0…
Dependabot just got better at using private npm registries!
Dependabot no longer infers.npmrc for npm private registries and now uses a scope property in dependabot.yml to generate the correct config.
github.blog/changelog/2026-0…
See ya never, Python 3.9! github.blog/changelog/2026-0…
As foreshadowed... github.blog/changelog/2026-0…
Dependabot retweeted
We're excited to announce Christopher Golda (@golda) and Grey Baker (@greybaker) as YC's newest General Partners!
Chris co-founded BackType (S08), sold it to Twitter, then built their entire ad business from zero to $1B+ in revenue.
Grey co-founded Dependabot, a developer tool a million engineers rely on every single day— and sold it to GitHub. Then he co-founded Pincites (S23), which was acquired by Filevine.
As Visiting Partners, both have already spent multiple batches working closely with founders. Now they're doing it full-time. ycombinator.com/blog/chris-g…
If we shipped version update cooldowns as a default, would you want it on, and what should the default be?
0%Yes, default 1 day
14%Yes, default 3 days
86%Yes, default 7 days
0%No, default 0 days
7 votes • Final results Dependabot retweeted
Dependabot now supports Deno 🚀
Add package-ecosystem: "deno" to your dependabot.yml and start getting automated dependency update PRs.
Nice addition from @GitHub @deno_land
Dependabot retweeted
Just published an episode about Nix support in Dependabot with Ankit Kumar Honey, senior engineering manager at GitHub, working on the Dependabot ecosystem, and Jamie Magee, principal software engineer at Microsoft, focusing on open source software and supply chain security, who contributed the Dependabot Nix support recently. Bump bump bump.
fulltimenix.com/episodes/dep…
@deno_land happy to have you in Dependabot version updates! github.blog/changelog/2026-0…
