Yes. GitHub's supported ecosystems page lists Terraform under the package ecosystem value terraform, with support for modules and providers. Modules can come from the Terraform Registry or a publicly reachable Git repository, and a private Terraform registry is supported through extra configuration.
What GitHub documents
From the supported ecosystems table, as read on 19 October 2026:
- Package ecosystem value:
terraform. - Terraform versions listed: 0.13 up to 1.15.x.
- Modules: supported from the Terraform Registry or a publicly reachable Git repository.
- Providers: supported.
- Private registries: supported for a private Terraform registry, by adding a git registry to
dependabot.yml.
The table also has columns for update types, and I could not confirm from the page which mark means version updates versus security updates for this row. Check the live table before you promise your team a specific behaviour.
Why it helps shared infrastructure repositories
Pins keep an upstream change from sneaking in. They also mean nothing moves unless someone moves it. In a repository shared by several teams, nobody owns that chore, and pins go stale. Automated pull requests turn the chore into a normal review.
See what the lock file protects for how provider selections are recorded. A bot that bumps a provider should update the lock file too, and reviewers should check that it did.
A minimal setup
The configuration lives in .github/dependabot.yml. A sketch:
version: 2
updates:
- package-ecosystem: "terraform"
directory: "/"
schedule:
interval: "weekly"
Add one entry per directory that holds Terraform configuration, since each root module is separate. Check the current options reference for fields such as grouping and limits on open pull requests.
Review rules for bot pull requests
A dependency bump is code that will run in your pipeline. Treat it as such.
- Read the changelog or release notes of the module or provider.
- Read the plan output. A version bump that plans resource replacement needs a human decision.
- Do not auto merge bumps for modules that create IAM, network or key resources.
- Require the same status checks and owners as any other change. See CODEOWNERS for bot opened pull requests.
Private registries
GitHub says private Terraform registries are supported by adding a git registry to dependabot.yml. Read the registry configuration section of GitHub's options reference for exact fields and how credentials are supplied.
Limits to keep in mind
Version support ends at a stated range, and the table lists 1.15.x as the upper end at the time of review. If you are on a newer Terraform release, confirm support before relying on it.
Where Safeguard fits
Safeguard offers SBOM and dependency scanning plus autonomous remediation with fix pull requests, which is off by default with every category on Manual. It does not scan Terraform for misconfigurations.
Try it yourself
Click through it at your own pace, or open it full screen.
Click a vulnerable dependency and look at how a fix pull request is presented for review.
Quick check
Do I need one Dependabot entry per Terraform directory?
Typically yes, because each directory is a separate configuration. Check GitHub's options reference for how directories are declared.
Should bot pull requests skip review?
No. Treat them like any change, read the plan, and avoid auto merge for modules that create IAM, network or key resources.
Sources
Last reviewed: 19 October 2026.
