Defaults differ a lot between layers. Ubuntu installs security updates automatically but does not reboot by default. Dependabot checks on a schedule you set, applies a three day cooldown to version updates, and limits open pull requests. Read the defaults before you assume anything is handled.
OS defaults: Ubuntu as an example
Per the Ubuntu Server documentation, unattended-upgrades is installed by default and runs daily, triggered by systemd timers. The allowed origins include the base release, the security pocket and ESM pockets where available, while the updates, proposed and backports pockets are commented out. Third party sources such as PPAs are excluded unless you add them. Automatic reboot defaults to false.
What that means in practice:
- Security fixes land without action.
- Fixes needing a restart may sit until someone restarts.
- Third party packages are not covered unless you add them.
See Ubuntu unattended upgrades: enable and reboot settings for the settings.
Dependency bot defaults: Dependabot as an example
The GitHub documentation says version updates are limited by open-pull-requests-limit, which defaults to five. Security update pull requests have a separate fixed limit of 10. A cooldown of three days applies to version updates by default, and it does not apply to security updates. Without grouping, each outdated dependency gets its own pull request. Security updates are triggered by alerts and open a pull request to the minimum patched version.
In practice:
- Nothing merges itself. A human or your auto merge rule decides.
- Security fixes are not slowed by the cooldown.
- Noise depends on grouping and limits you set.
Compare the two
| Question | OS tool default | Dependency bot default |
|---|---|---|
| Applies without a human? | Yes, for security origins | No, it proposes a pull request |
| Restart or deploy? | Reboot off | Deploy is your pipeline |
| Third party sources? | Excluded | Depends on ecosystem config |
| Delay for new releases? | Not applicable | Three days for version updates |
A short review checklist
- Confirm the OS updater is running and which origins it covers.
- Decide on reboot handling, in a window or via rolling replacement.
- Add the third party repositories you actually use.
- Set the bot schedule, grouping and limits on purpose.
- Decide what, if anything, may auto merge. See should I turn on Dependabot auto merge.
- Test the whole path on one service before rolling it out.
Check again after changes
Vendors change defaults. Verify against current documentation when you set this up, and note the date in your runbook.
Where Safeguard fits
Safeguard's SBOM and dependency scanning, policies and gates sit above both layers, so you can see what automatic tools did and what they missed.
Quick check
Do automatic OS updates cover application libraries?
No. They cover packages from the configured system repositories only.
Does automatic mean patched?
Installed, maybe. Running and verified needs the restart or deploy and a check.
Sources
- Ubuntu Server documentation: automatic updates
- GitHub Docs: Dependabot configuration options
- GitHub Docs: About Dependabot security updates
Last reviewed: 19 October 2026.
