Dependabot

Dependency update PR bot

FreeCode review, testing & securitydocs.github.com

What it is

GitHub-native bot with three jobs: alerts for vulnerable dependencies drawn from the GitHub Advisory Database, security updates that automatically open pull requests bumping to a patched version, and scheduled version updates configured in .github/dependabot.yml. Grouped updates and auto-merge rules keep pull request volume manageable.

Why it earns a slot

Zero-cost, near-zero-config baseline. The package.json your agent wrote will drift into known-CVE territory within months, and this is the one tool that quietly fixes it while you sleep.

Know before you commit

It only knows advisories already published to GitHub's database, so brand-new malicious packages slip through; pair it with Socket. It also skips archived repos, and ungrouped updates get spammy fast.

Getting started

Enable under repo Settings > Code security, then add .github/dependabot.yml

Field notes

0 from the community

Loading notes…

Field check

Unverified

Pricing snapshot

$0 on all GitHub repositories, public and private, including private repos on the free GitHub plan

Snapshots move fast — verify at checkout, and post a field note if it changed.

Drop into your Lovable chat

Evaluate Dependabot (https://docs.github.com/en/code-security/dependabot) for this project, then use it only if it fits what we are already building.
Context: Dependency update PR bot. GitHub-native bot with three jobs: alerts for vulnerable dependencies drawn from the GitHub Advisory Database, security updates that automatically open pull requests bumping to a patched version, and scheduled version updates configured in .github/dependabot.yml. Grouped updates and auto-merge rules keep pull request volume manageable.
Reviewer notes (general, not written for this codebase): Zero-cost, near-zero-config baseline. The package.json your agent wrote will drift into known-CVE territory within months, and this is the one tool that quietly fixes it while you sleep.
Watch out for: It only knows advisories already published to GitHub's database, so brand-new malicious packages slip through; pair it with Socket. It also skips archived repos, and ungrouped updates get spammy fast.
Pricing: $0 on all GitHub repositories, public and private, including private repos on the free GitHub plan
Setup: Enable under repo Settings > Code security, then add .github/dependabot.yml
Rules: treat the notes above as background only. Do not assume a theme, style, layout or feature that is not already in this project — inspect the existing code first and ask me before changing visual direction.

/api/public/tools/dependabot

Neighbourhood

How Dependabot sits against the rest of the atlas — swaps, companions and the tools builders actually save alongside it.

Instead of thisGitleaks Playwright Stagehand Storybook test runner Testing Library Trivy Vitest Aikido Security Arcjet

Named in the wiringgithub-mcp

Also in Code review, testing & security

Aikido Security

aikido.dev

All-in-one AppSec scanner

Free tier + paidCode review, testing & security

Developer free forever: 2 users, 10 repos, 2 container images, 1 domain, 250k protected requests/mo, 10 AI autofixes/mo; Basic $300/mo base for 10 users and 100 repos; Pro $600/mo for 200 repos; Advanced $600/mo for 500 repos; Enterprise custom

Open dossier

Arcjet

arcjet.com

In-app rate limiting and bot defence

PaidCode review, testing & security

No free plan as of 2026; Individual $25/app/mo; Startup $299/app/mo; Growth $799/app/mo; usage fees on top at $5 per 1M requests plus per-feature rates such as $0.50 per 1M for bot detection; 15-day trial

Open dossier

Bito

bito.ai

AI PR review agent

PaidCode review, testing & security

Team $12/seat/mo annually or $15 monthly; Professional $20/seat/mo annually or $25 monthly; both include 5,000 lines reviewed per seat per month, overage $5 per 1,000 lines; Enterprise custom; 14-day trial

Open dossier

Browserbase

browserbase.com

Hosted headless browser cloud

Free tier + paidCode review, testing & security

Free: 1 browser hour/mo; Developer $20/mo with 100 browser hours then $0.12/hr; Startup $99/mo with 500 hours then $0.10/hr; Scale custom with 250+ concurrent browsers

Open dossier