Dependabot version updates support more than application libraries. GitHub's ecosystem list includes github-actions, docker, docker-compose, devcontainers, pre-commit, opentofu, helm, nix and gitsubmodule, among others. Enabling those turns much of your developer tooling patching into reviewable pull requests instead of memory and good intentions.
The tooling ecosystems
These entries appear in GitHub's supported ecosystems table with version updates support. The table was long, so check the page for the full current list.
| Ecosystem value | What it keeps current |
|---|---|
| github-actions | Actions referenced in workflow files |
| docker | Base image tags and digests in Dockerfiles |
| docker-compose | Images in Compose files |
| devcontainers | Dev container definitions |
| pre-commit | Hook repository revisions |
| opentofu | OpenTofu configurations |
| helm | Helm charts |
| nix | Nix inputs |
| gitsubmodule | Git submodule pointers |
Why tooling gets missed
Teams set up updates for package.json or requirements files and stop there. The pipeline definition, the build image, the dev container and the hooks stay frozen, even though they run with real credentials and touch every build.
A starter configuration
version: 2
updates:
- package-ecosystem: "github-actions"
directory: "/"
schedule:
interval: "weekly"
- package-ecosystem: "docker"
directory: "/"
schedule:
interval: "weekly"
- package-ecosystem: "devcontainers"
directory: "/"
schedule:
interval: "weekly"
Add a pre-commit entry the same way if your repository uses it. A weekly schedule keeps pull requests small enough to read.
What the update bot does not do
Version updates move you to a newer release. They do not judge whether the new release is trustworthy. Someone still needs to read the diff, especially for third-party actions and hooks. Pair the bot with an approval rule and a short checklist.
Also remember that SHA-pinned actions produce no Dependabot alerts, so version updates are the channel that keeps them moving. Details are in how to pin GitHub Actions to a SHA without falling behind.
Review checklist for an update pull request
- Who maintains the project, and did that change recently?
- What does the diff add: network calls, new permissions, new install steps?
- Does CI pass on the pull request branch?
- Is there a release note that explains the change?
- Can you roll it back with a single revert?
Where Safeguard fits
Safeguard's policies and gates check pull requests, including update pull requests, and its dependency scanning and SBOM generation cover what those updates change. Autonomous remediation with fix PRs is available but off by default, with every category on Manual. Try a free scan at gold.safeguard.sh/scan.
Common mistakes
Teams enable the bot for libraries only, set a daily schedule that floods reviewers, or let update pull requests sit open for weeks. Start weekly, group related updates if your setup allows, and agree who reviews them.
Try it yourself
Click through it at your own pace, or open it full screen.
Look at how a fix and its pull request are presented, and what you would check before merging.
Quick check
Does Dependabot update Dockerfiles?
Yes. The docker ecosystem is listed with version updates support in GitHub's table.
Can it update pre-commit hooks?
Yes, pre-commit appears in the supported ecosystems list.
Sources
Last reviewed: 19 October 2026.
