Dependabot has three separate features. Alerts tell you a dependency has a known vulnerability. Security updates open a pull request to fix it. Version updates open pull requests to keep dependencies current even when nothing is vulnerable. Each is switched on differently.
Safeguard publishes this guide and sells a competing product, so we describe other tools only from their own documentation. Facts below are as of 19 October 2026.
Key takeaways
- Alerts are based on the GitHub Advisory Database, and only advisories reviewed by GitHub trigger them.
- Security updates respond to alerts and bump to the lowest version that contains the patch.
- Version updates are enabled by checking a dependabot.yml file into the repository.
- A default 3 day cooldown applies to version updates but not security updates.
What does each Dependabot feature do?
Each feature has a different trigger and a different output.
| Criteria | Alerts | Security updates | Version updates |
|---|---|---|---|
| What it does | Notifies about vulnerable dependencies | Opens a pull request to fix a vulnerable dependency | Opens pull requests to update to the latest versions |
| Trigger | New advisory, or dependency graph change | An open alert with an available patch | Your dependabot.yml configuration |
| Needs vulnerability | Yes | Yes | No |
| Configured by | Repository or organization settings | Repository settings, alerts enabled | dependabot.yml file |
How do alerts work?
Alerts appear in the repository's security tab and dependency graph with severity and a fixed version when available. Dependabot scans the default branch. The docs list limits, including that alerts cannot catch every issue, new vulnerabilities can take time to appear, and archived repositories are not scanned.
How do security updates work?
Security updates open a pull request that updates the dependency to the lowest version containing the patch. Dependency graph and Dependabot alerts must be enabled first. Merging the pull request closes the alert. For npm, Dependabot may also update a parent dependency. For other ecosystems, it cannot update an indirect dependency if that requires updating the parent. When enabled, it opens pull requests for every open alert that has an available patch. To choose which alerts get pull requests, the docs suggest keeping security updates off and creating an auto-triage rule.
How do version updates work?
Version updates keep dependencies current even when they have no vulnerabilities. You enable them by checking a dependabot.yml file into the repository that says where your manifests live. Dependabot uses semantic versioning to decide whether to update. If maintainers stop interacting with its pull requests, it pauses updates and notifies you.
How to choose
- Turn on alerts first, since security updates depend on them.
- Turn on security updates if you want fix pull requests for every patchable alert.
- Add version updates if you want routine upgrades, and set the cooldown to suit you.
- Use auto-triage rules if pull request volume is too high.
To check a dependency list outside GitHub, the free scan at gold.safeguard.sh/scan runs in your browser with no login.
Frequently asked questions
Do version updates need a vulnerability?
No. The docs say they keep dependencies updated even when they have no vulnerabilities.
Do security updates need alerts enabled?
Yes. The docs state that the dependency graph and Dependabot alerts must be enabled.
Does the cooldown apply to security updates?
No. The docs say the default 3 day cooldown applies to version updates but not to security updates.
Sources
- About Dependabot alerts: https://docs.github.com/en/code-security/dependabot/dependabot-alerts/about-dependabot-alerts
- About Dependabot security updates: https://docs.github.com/en/code-security/dependabot/dependabot-security-updates/about-dependabot-security-updates
- About Dependabot version updates: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/about-dependabot-version-updates
Last reviewed: 19 October 2026.
