Does Dependabot update Helm charts and GitHub Actions in shared repos?

Yes, with a difference. GitHub documents Helm charts under the ecosystem helm with version updates but not security updates, and GitHub Actions under github-actions with both version and security updates. Both support private repositories and registries, per the supported ecosystems page.

What GitHub's table says

Read on 19 October 2026:

Terraform has its own post: Dependabot for Terraform modules and providers.

What "no security updates" means for Helm

A version update is a routine bump to a newer release. A security update is a pull request raised because an advisory affects a version you use. For Helm charts, only the routine kind is listed. If a chart you depend on has a vulnerable dependency, Dependabot will not open a security pull request for it, according to the table.

That does not mean you are blind. You still receive routine bumps, and other tooling can inventory the images and charts you use. It does mean you should not treat the absence of a Dependabot alert as evidence a chart is clean.

Why this matters for shared repositories

Shared chart repositories and shared CI configuration share a problem: lots of consumers, no obvious owner for upkeep.

• A shared chart that pins old subcharts leaves every consumer on old subcharts.
• A shared reusable workflow that references an old action keeps every pipeline on it.

For workflows, GitHub's own security guidance says to pin actions to a full length commit SHA, and a bot that raises update pull requests makes pinned SHAs practical to maintain. See pinning actions: SHA or tag.

A setup sketch

version: 2
updates:
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"
  - package-ecosystem: "helm"
    directory: "/charts/platform"
    schedule:
      interval: "weekly"

The directory for Helm should point at the folder containing the chart. Check GitHub's options reference for details such as multiple directories.

Reviewing bot pull requests

1. For an action bump, read the release notes and confirm the new SHA belongs to the action's own repository, not a fork.
2. For a chart dependency bump, run the chart's tests and look at the rendered output differences.
3. Keep CODEOWNERS on .github/workflows so workflow changes need a designated reviewer. See CODEOWNERS protect workflow files.
4. Never grant the bot more repository permissions than it needs.

A gap worth covering

Because Helm has no security updates in this table, pair routine bumps with an inventory of what your charts pull in. Safeguard's SBOM and dependency scanning can build that inventory for repositories. Safeguard also offers autonomous remediation with fix pull requests, off by default with every category on Manual.

Try it yourself

Click through it at your own pace, or open it full screen.

Click into a dependency and see where it comes from and which versions are in use.

Quick check

Sources

• GitHub: supported ecosystems and repositories for Dependabot
• GitHub: security hardening for GitHub Actions

Last reviewed: 19 October 2026.