Dependabot security updates fix only what manifests and lock files declare: plan for the alerts it cannot close

GitHub’s Dependabot can open pull requests that move vulnerable dependencies to the minimum patched version, but only for dependencies in a manifest or lock file, and outside npm it cannot fix a transitive dependency that needs a parent update.

Source facts

According to GitHub Docs, when security updates are enabled and an alert is raised for a vulnerable dependency, Dependabot checks whether it can upgrade to a fixed version without disrupting the dependency graph, then raises a pull request to the minimum version that includes the patch or reports an error on the alert. It requires the dependency graph and Dependabot alerts, and it can also update vulnerable GitHub Actions used in workflows.

Alerts cover the full dependency graph, but security updates are triggered only for dependencies specified in a manifest or lock file. For ecosystems other than npm, Dependabot cannot update an indirect dependency when that would also require updating its parent.

Compatibility scores, where shown, are the percentage of CI runs in other public repositories that passed for the same update. When maintainers stop interacting with Dependabot pull requests, Dependabot temporarily pauses its updates.

Applicability

Use this for repositories in any ecosystem Dependabot supports. GitHub lists the feature as available for all repositories on GitHub, so the limits above, not plan level, are what usually leave gaps.

DSE recommendation

DSE recommends enabling Dependabot alerts and security updates on every maintained custom-software repository and assigning an owner for the alerts Dependabot cannot fix itself. Commit lock files so updates can target exact versions, review and test every Dependabot pull request through the normal pipeline rather than auto-merging on a compatibility score, and track errored or transitive-only alerts as manual work items with due dates.

Verification

Each month, compare open Dependabot alerts with open or merged Dependabot pull requests for each repository. Any alert without a pull request, any errored alert and any paused repository should appear on the owner’s work list until fixed, accepted or documented as not exploitable.

Official reference

GitHub Docs — Dependabot security updates. Reviewed October 18, 2026.