{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/dependabot-security-updates-coverage-gaps-custom-software/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/dependabot-security-updates-coverage-gaps-custom-software/",
        "slug": "dependabot-security-updates-coverage-gaps-custom-software",
        "url": "https://update.dsesecurity.com/updates/dependabot-security-updates-coverage-gaps-custom-software/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/dependabot-security-updates-coverage-gaps-custom-software.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/dependabot-security-updates-coverage-gaps-custom-software/"
        },
        "title": "Dependabot security updates fix only what manifests and lock files declare: plan for the alerts it cannot close",
        "summary": "GitHub’s Dependabot can open pull requests that move vulnerable dependencies to the minimum patched version, but only for dependencies in a manifest or lock file, and outside npm it cannot fix a transitive dependency that needs a parent update.",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "cyber-defense",
            "label": "Cyber defense",
            "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "cybersecurity",
                "name": "Cybersecurity",
                "url": "https://update.dsesecurity.com/topic/cybersecurity/"
            },
            {
                "slug": "it",
                "name": "IT",
                "url": "https://update.dsesecurity.com/topic/it/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-10-18T21:00:16+00:00",
        "modified_at": "2026-10-18T22:22:06+00:00",
        "reviewed_on": "2026-10-18",
        "reading_minutes": 2,
        "word_count": 341,
        "potentially_affected": "Custom applications, websites and internal tools whose source code is kept in GitHub repositories, including code maintained by contractors on a client’s behalf.",
        "dse_recommendation": "DSE recommends enabling Dependabot alerts and security updates on every maintained custom-software repository and assigning an owner for the alerts Dependabot cannot fix itself.",
        "primary_source": {
            "name": "GitHub Docs — Dependabot security updates",
            "url": "https://docs.github.com/en/code-security/concepts/supply-chain-security/dependabot-security-updates",
            "published_on": null,
            "authority": "docs.github.com"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<p>GitHub’s Dependabot can open pull requests that move vulnerable dependencies to the minimum patched version, but only for dependencies in a manifest or lock file, and outside npm it cannot fix a transitive dependency that needs a parent update.</p>\n<h2>Source facts</h2>\n<p>According to <a href=\"https://docs.github.com/en/code-security/concepts/supply-chain-security/dependabot-security-updates\">GitHub Docs</a>, when security updates are enabled and an alert is raised for a vulnerable dependency, Dependabot checks whether it can upgrade to a fixed version without disrupting the dependency graph, then raises a pull request to the minimum version that includes the patch or reports an error on the alert. It requires the dependency graph and Dependabot alerts, and it can also update vulnerable GitHub Actions used in workflows.</p>\n<p>Alerts cover the full dependency graph, but security updates are triggered only for dependencies specified in a manifest or lock file. For ecosystems other than npm, Dependabot cannot update an indirect dependency when that would also require updating its parent.</p>\n<p>Compatibility scores, where shown, are the percentage of CI runs in other public repositories that passed for the same update. When maintainers stop interacting with Dependabot pull requests, Dependabot temporarily pauses its updates.</p>\n<h2>Applicability</h2>\n<p>Use this for repositories in any ecosystem Dependabot supports. GitHub lists the feature as available for all repositories on GitHub, so the limits above, not plan level, are what usually leave gaps.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends enabling Dependabot alerts and security updates on every maintained custom-software repository and assigning an owner for the alerts Dependabot cannot fix itself. Commit lock files so updates can target exact versions, review and test every Dependabot pull request through the normal pipeline rather than auto-merging on a compatibility score, and track errored or transitive-only alerts as manual work items with due dates.</p>\n<h2>Verification</h2>\n<p>Each month, compare open Dependabot alerts with open or merged Dependabot pull requests for each repository. Any alert without a pull request, any errored alert and any paused repository should appear on the owner’s work list until fixed, accepted or documented as not exploitable.</p>\n<h2>Official reference</h2>\n<p><a href=\"https://docs.github.com/en/code-security/concepts/supply-chain-security/dependabot-security-updates\">GitHub Docs — Dependabot security updates</a>. Reviewed October 18, 2026.</p>",
        "content_text": "GitHub’s Dependabot can open pull requests that move vulnerable dependencies to the minimum patched version, but only for dependencies in a manifest or lock file, and outside npm it cannot fix a transitive dependency that needs a parent update.\nSource facts\nAccording to GitHub Docs, when security updates are enabled and an alert is raised for a vulnerable dependency, Dependabot checks whether it can upgrade to a fixed version without disrupting the dependency graph, then raises a pull request to the minimum version that includes the patch or reports an error on the alert. It requires the dependency graph and Dependabot alerts, and it can also update vulnerable GitHub Actions used in workflows.\nAlerts cover the full dependency graph, but security updates are triggered only for dependencies specified in a manifest or lock file. For ecosystems other than npm, Dependabot cannot update an indirect dependency when that would also require updating its parent.\nCompatibility scores, where shown, are the percentage of CI runs in other public repositories that passed for the same update. When maintainers stop interacting with Dependabot pull requests, Dependabot temporarily pauses its updates.\nApplicability\nUse this for repositories in any ecosystem Dependabot supports. GitHub lists the feature as available for all repositories on GitHub, so the limits above, not plan level, are what usually leave gaps.\nDSE recommendation\nDSE recommends enabling Dependabot alerts and security updates on every maintained custom-software repository and assigning an owner for the alerts Dependabot cannot fix itself. Commit lock files so updates can target exact versions, review and test every Dependabot pull request through the normal pipeline rather than auto-merging on a compatibility score, and track errored or transitive-only alerts as manual work items with due dates.\nVerification\nEach month, compare open Dependabot alerts with open or merged Dependabot pull requests for each repository. Any alert without a pull request, any errored alert and any paused repository should appear on the owner’s work list until fixed, accepted or documented as not exploitable.\nOfficial reference\nGitHub Docs — Dependabot security updates. Reviewed October 18, 2026.",
        "content_markdown": "GitHub’s Dependabot can open pull requests that move vulnerable dependencies to the minimum patched version, but only for dependencies in a manifest or lock file, and outside npm it cannot fix a transitive dependency that needs a parent update.\n\n## Source facts\n\nAccording to [GitHub Docs](https://docs.github.com/en/code-security/concepts/supply-chain-security/dependabot-security-updates), when security updates are enabled and an alert is raised for a vulnerable dependency, Dependabot checks whether it can upgrade to a fixed version without disrupting the dependency graph, then raises a pull request to the minimum version that includes the patch or reports an error on the alert. It requires the dependency graph and Dependabot alerts, and it can also update vulnerable GitHub Actions used in workflows.\n\nAlerts cover the full dependency graph, but security updates are triggered only for dependencies specified in a manifest or lock file. For ecosystems other than npm, Dependabot cannot update an indirect dependency when that would also require updating its parent.\n\nCompatibility scores, where shown, are the percentage of CI runs in other public repositories that passed for the same update. When maintainers stop interacting with Dependabot pull requests, Dependabot temporarily pauses its updates.\n\n## Applicability\n\nUse this for repositories in any ecosystem Dependabot supports. GitHub lists the feature as available for all repositories on GitHub, so the limits above, not plan level, are what usually leave gaps.\n\n## DSE recommendation\n\nDSE recommends enabling Dependabot alerts and security updates on every maintained custom-software repository and assigning an owner for the alerts Dependabot cannot fix itself. Commit lock files so updates can target exact versions, review and test every Dependabot pull request through the normal pipeline rather than auto-merging on a compatibility score, and track errored or transitive-only alerts as manual work items with due dates.\n\n## Verification\n\nEach month, compare open Dependabot alerts with open or merged Dependabot pull requests for each repository. Any alert without a pull request, any errored alert and any paused repository should appear on the owner’s work list until fixed, accepted or documented as not exploitable.\n\n## Official reference\n\n[GitHub Docs — Dependabot security updates](https://docs.github.com/en/code-security/concepts/supply-chain-security/dependabot-security-updates). Reviewed October 18, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/dependabot-security-updates-coverage-gaps-custom-software/",
                "url": "https://update.dsesecurity.com/updates/dependabot-security-updates-coverage-gaps-custom-software/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-10-18"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/dependabot-security-updates-coverage-gaps-custom-software/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Dependabot security updates fix only what manifests and lock files declare: plan for the alerts it cannot close",
                        "item": "https://update.dsesecurity.com/updates/dependabot-security-updates-coverage-gaps-custom-software/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/dependabot-security-updates-coverage-gaps-custom-software/#article",
                "identifier": "https://update.dsesecurity.com/updates/dependabot-security-updates-coverage-gaps-custom-software/",
                "url": "https://update.dsesecurity.com/updates/dependabot-security-updates-coverage-gaps-custom-software/",
                "headline": "Dependabot security updates fix only what manifests and lock files declare: plan for the alerts it cannot close",
                "description": "GitHub’s Dependabot can open pull requests that move vulnerable dependencies to the minimum patched version, but only for dependencies in a manifest or…",
                "abstract": "GitHub’s Dependabot can open pull requests that move vulnerable dependencies to the minimum patched version, but only for dependencies in a manifest or lock file, and outside npm it cannot fix a transitive dependency that needs a parent update.",
                "articleBody": "GitHub’s Dependabot can open pull requests that move vulnerable dependencies to the minimum patched version, but only for dependencies in a manifest or lock file, and outside npm it cannot fix a transitive dependency that needs a parent update.\nSource facts\nAccording to GitHub Docs, when security updates are enabled and an alert is raised for a vulnerable dependency, Dependabot checks whether it can upgrade to a fixed version without disrupting the dependency graph, then raises a pull request to the minimum version that includes the patch or reports an error on the alert. It requires the dependency graph and Dependabot alerts, and it can also update vulnerable GitHub Actions used in workflows.\nAlerts cover the full dependency graph, but security updates are triggered only for dependencies specified in a manifest or lock file. For ecosystems other than npm, Dependabot cannot update an indirect dependency when that would also require updating its parent.\nCompatibility scores, where shown, are the percentage of CI runs in other public repositories that passed for the same update. When maintainers stop interacting with Dependabot pull requests, Dependabot temporarily pauses its updates.\nApplicability\nUse this for repositories in any ecosystem Dependabot supports. GitHub lists the feature as available for all repositories on GitHub, so the limits above, not plan level, are what usually leave gaps.\nDSE recommendation\nDSE recommends enabling Dependabot alerts and security updates on every maintained custom-software repository and assigning an owner for the alerts Dependabot cannot fix itself. Commit lock files so updates can target exact versions, review and test every Dependabot pull request through the normal pipeline rather than auto-merging on a compatibility score, and track errored or transitive-only alerts as manual work items with due dates.\nVerification\nEach month, compare open Dependabot alerts with open or merged Dependabot pull requests for each repository. Any alert without a pull request, any errored alert and any paused repository should appear on the owner’s work list until fixed, accepted or documented as not exploitable.\nOfficial reference\nGitHub Docs — Dependabot security updates. Reviewed October 18, 2026.",
                "datePublished": "2026-10-18T21:00:16+00:00",
                "dateModified": "2026-10-18T22:22:06+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/dependabot-security-updates-coverage-gaps-custom-software/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/dependabot-security-updates-coverage-gaps-custom-software/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Dependabot security updates fix only what manifests and lock files declare: plan for the alerts it cannot close"
                },
                "articleSection": [
                    "Cybersecurity",
                    "IT"
                ],
                "keywords": [
                    "Cybersecurity",
                    "IT",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Cybersecurity",
                        "url": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "IT",
                        "url": "https://update.dsesecurity.com/topic/it/"
                    }
                ],
                "wordCount": 341,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "GitHub Docs — Dependabot security updates",
                    "url": "https://docs.github.com/en/code-security/concepts/supply-chain-security/dependabot-security-updates"
                }
            }
        ]
    }
}