Dependabot in production: dependabot.yml, security updates, auto-merge and troubleshooting

When Dependabot alerts pile into double digits, which do you fix first? Sorting by severity (CVSS) alone gets the priority wrong. Faithful to the official docs, this guide combines CVSS (how bad the impact) with EPSS (the probability of being attacked, updated daily by FIRST) on two axes, then covers reachability, dependency scope, auto-triage rules (matching on severity/EPSS/scope), and REST-API inventory — a triage design that cuts alert fatigue and focuses on the truly dangerous few, with real code.

An implementation guide to safely auto-merging Dependabot PRs with GitHub Actions. Faithful to the official documentation (as of June 2026), it explains, with copy-paste real code: all outputs of dependabot/fetch-metadata@v3, conditional branching by update-type, gh pr merge --auto, the token model of a read-only GITHUB_TOKEN and Dependabot secrets, using pull_request vs. pull_request_target, and how to build safety valves with required checks and branch protection.

An implementation guide to keep Dockerfile / Docker Compose base images safely updated with Dependabot. Faithful to the official documentation (as of June 2026), it explains, with copy-paste real code: the docker / docker-compose ecosystem configuration, the difference between tag updates and digest pinning (image:tag@sha256:...), countermeasures for CVEs accumulated by silent rebuilds, multi-stage and private-registry (ECR/Artifact Registry) integration, and the reason to be careful with auto-merge.

A practical guide to pinning GitHub Actions' uses: from a mutable tag to a commit SHA and keeping it safely updated with Dependabot. Faithful to the official security-hardening guidance (as of June 2026), it explains, with real code, why tag references are dangerous, SHA pinning + version comments, Dependabot's behavior of updating the SHA and comment together, bulk-pinning an existing repository, and defense in depth — least-privilege GITHUB_TOKEN, allowing only trusted actions, and a policy enforcing SHA pinning.

A design guide for operating Dependabot without breaking on a monorepo (Turborepo / pnpm/npm/yarn workspaces / Nx). Faithful to the official documentation (as of June 2026), it explains, in copy-paste real code: consolidating into one entry with directories globs, the relationship between workspaces and the lockfile, bundling PRs across directories with groups and group-by: dependency-name, per-package policies, and integration with CI that tests only the affected scope.

An implementation guide to updating internal/private-registry dependencies with Dependabot. Faithful to the official documentation (as of June 2026), it explains, with copy-paste real code and least-privilege design: the authentication fields per registries-block type, Dependabot secrets (≠ Actions secrets), GitHub Packages auto-authentication, OIDC for AWS CodeArtifact / Google Artifact Registry / JFrog Artifactory, static AWS auth for ECR, and self-hosted runners (the dependabot label) that reach a private network.

A guide to operating GitHub's Dependabot alerts and security updates at production quality. Faithful to the official documentation (as of June 2026), it explains, with real code, the difference between alerts and security updates, the prerequisites for enabling them, how to prevent alert fatigue with auto-triage rules, grouped security updates, triage operations with an SLA, and observability via the REST API, including the role division between SCA and SAST/DAST.

Dependabot doesn't create PRs, doesn't fix vulnerabilities, or errors on a private registry — a practical guide to isolating and fixing common stalls by cause. Faithful to the official documentation (as of June 2026), it explains, with copy-paste confirmation steps: the typical causes of 'no PRs come,' Cannot update to a non-vulnerable version, private_source_* errors, how to read logs, and the latest spec of the @dependabot comment commands that changed in January 2026.

A practitioner's tech-selection guide comparing the dependency auto-update tools Dependabot and Renovate. GitHub-native zero-config vs 90+ package managers, multi-Git platforms, a Dependency Dashboard, and grouping presets. It lays out the differences in pricing (free on standard runners / free Mend-hosted + paid add-ons), self-hosting, monorepos, and security integration in a comparison table, and gives situation-by-situation selection criteria and the inputs for a migration decision.

Compare SCA tools that find dependency vulnerabilities — Dependabot, Snyk, Trivy, OSV-Scanner, npm audit — by detection, fix PRs, reachability, container/IaC, SBOM, and pricing, with a practical selection flow and the SCA-vs-SAST/DAST line.

A configuration complete guide for writing GitHub's dependabot.yml at production quality. Faithful to the official configuration reference (as of June 2026), it explains, with copy-pasteable real examples, the full supported list of package-ecosystem, directory and directories (glob), schedule and cooldown, groups (applies-to / group-by), the priority of allow and ignore, registries and private-registry authentication, commit-message, target-branch, and multi-ecosystem-groups.