Automated dependency updates with Dependabot or Renovate
Why it matters
Most breaches through dependencies use vulnerabilities that already had a patch. A bot that opens the update as a pull request the day the patch ships closes that window without anyone remembering to.
How to fix it
What to do: Create
.github/dependabot.yml for automatic dependency updates.version: 2
updates:
- package-ecosystem: pip
directory: "/"
schedule:
interval: weekly
day: monday
open-pull-requests-limit: 5
labels: [dependencies, automated]
Does your repository pass this check?
Free for public GitHub repositories, no account needed. 50+ DevOps and security checks in about ten seconds.
Public repositories where this check fails
Related checks
- How to find and remove secrets committed to a Git repository
- Why .env must be in .gitignore (and how to check it is not already committed)
- A .env file is committed to the repository: what to do
- How to pin GitHub Actions to a commit SHA
- Least-privilege GITHUB_TOKEN permissions in workflows
- The pull_request_target trap in GitHub Actions