GitHub Dependabot
Alerts and pull requests when a dependency you already use has a known vulnerability.
Last updated
- Free tier
- Yes
- Checked
- 2026-10-13
What the public pages say
Dependabot is the lowest-friction way to hear about known-bad versions if you already use GitHub. Enable alerts and security updates, and read the advisory before you merge a major bump.
It watches published vulnerabilities in dependencies. It does not review the authorization in code you wrote.
Free tier
GitHub's security features page lists Dependabot alerts, security updates, version updates, and malware alerts under features available regardless of plan, without purchasing GitHub Code Security. The same page says most of those features are available for public and private repositories, and that some features are public-only. It also says custom auto-triage rules and dependency review are part of GitHub Code Security, with dependency review available for public repositories by default.
Not stated on the vendor's site
- The overview page does not spell out a numeric alert quota for private repositories on the free GitHub plan.
Sources
Markdown version · Canonical page: https://shipsecurely.dev/tools/github-dependabot