dependabot.yml
AssessTools
The configuration file used to control Dependabot update schedules, grouping, and limits.
Why it's here
Placed in Assess: 9 article(s) of evidence from 5 source(s), led by security coverage, with 0 in the last 30 days. Confidence 81%.
Evidence (9)
- 4GitHub Blog·8/26/2026product_launchGitHub Copilot automates Dependabot pull request triage
GitHub describes a Copilot app automation workflow that reviews open Dependabot pull requests, groups updates by risk, checks CI status, and produces a daily summary. The automation is designed to reduce repetitive maintenance work and let developers focus on higher-priority decisions or follow-up migration tasks.
- 7Hacker News·8/21/2026securityFelony Bench ranks AI agent security incidents
Felony Bench is a benchmark that scores AI models and agents by the number of illegal or harmful real-world incidents they have been associated with, rather than by task performance. The page lists recent cases involving Anthropic, OpenAI, Meta, Google, and Moonshot, and explains that only unique incidents affecting third parties are counted.
- 7GitHub Blog·8/13/2026securityGitHub says 50 open source projects improved security with AI-era support
GitHub says the fourth session of its Secure Open Source Fund helped 50 projects strengthen security through funding, expert guidance, security tooling, and AI-assisted workflows. The program produced concrete outcomes such as incident response plans, expanded GitHub security feature adoption, workflow audits, and faster vulnerability triage and remediation.
- 8GitHub Blog·8/6/2026securityGitHub expands malware advisories beyond npm
GitHub says Dependabot malware advisories now cover eight package ecosystems, including PyPI, by ingesting reports from OpenSSF’s malicious-packages repository. The update replaces a GitHub-only npm path with a shared importer that validates and normalizes OSV-format malware reports before they reach the advisory database.
- 5GitHub Blog·7/29/2026open_sourceGitHub recommends grouping Dependabot updates into slower monthly batches
GitHub Blog describes a way to reduce Dependabot noise by grouping dependency updates and changing the check cadence from daily to monthly. The approach keeps security updates flowing while cutting down on pull request volume, CI runs, and review overhead, especially in active repositories and monorepos.
- 4InfoQ·7/14/2026securityGitHub adds a three-day cooldown for Dependabot updates
GitHub has changed Dependabot so it now waits until a new release has been available in its registry for at least three days before opening a version update pull request. The cooldown is now the default behavior and does not require any configuration.
- 7GitHub Blog·7/1/2026securityGitHub urges maintainers to enable key security settings
GitHub Security Lab highlights six free security settings that maintainers can enable in under 30 minutes to improve project security posture. The recommendations include adding a SECURITY.md file, enabling private vulnerability reporting, secret scanning with push protection, Dependabot and dependency review, and code scanning.
- 4Martin Fowler·5/20/2026researchThree More Static Code Analysis Sensors
Martin Fowler highlights a practical follow-up on using static code analysis and related sensors to help coding agents keep codebases maintainable. The article discusses feedback tools such as linting, dependency rules, coupling analysis, modularity review, and mutation testing to catch issues early and support self-correction.
- 5Martin Fowler·5/19/2026researchMaintainability sensors for coding agents
The article describes practical experiments with using automated “sensors” to help AI coding agents keep a codebase maintainable. It highlights tools such as linting, dependency checks, test coverage, mutation testing, and structural analysis to catch maintainability issues early and support self-correction before changes reach humans.