{
  "slug": "dependabot",
  "name": "Dependabot",
  "url": "https://docs.github.com/en/code-security/dependabot",
  "cat": "review",
  "group": "ship",
  "tagline": "Dependency update PR bot",
  "price": "$0 on all GitHub repositories, public and private, including private repos on the free GitHub plan",
  "tier": "free",
  "pick": false,
  "what": "GitHub-native bot with three jobs: alerts for vulnerable dependencies drawn from the GitHub Advisory Database, security updates that automatically open pull requests bumping to a patched version, and scheduled version updates configured in <code>.github/dependabot.yml</code>. Grouped updates and auto-merge rules keep pull request volume manageable.",
  "why": "Zero-cost, near-zero-config baseline. The <code>package.json</code> your agent wrote will drift into known-CVE territory within months, and this is the one tool that quietly fixes it while you sleep.",
  "warn": "It only knows advisories already published to GitHub's database, so brand-new malicious packages slip through; pair it with Socket. It also skips archived repos, and ungrouped updates get spammy fast.",
  "install": "Enable under repo Settings > Code security, then add .github/dependabot.yml",
  "category": {
    "key": "review",
    "name": "Code review, testing & security",
    "desc": "The single biggest risk in vibe coding is shipping AI code nobody read. This is the fix.",
    "group": "ship",
    "groupName": "Ship it & keep it alive"
  },
  "freshness": null,
  "health": {
    "ok": true,
    "status_code": 200,
    "final_url": "https://docs.github.com/en/code-security/how-tos/secure-your-supply-chain",
    "checked_at": "2026-08-19T00:17:14.278+00:00"
  },
  "corrected_at": null,
  "upstream_changed_at": null
}