Dependabot

tl;dr in 60 days, alerts closed 2 or more years ago are moving to archival storage. you will still be able to download them if you need them. github.blog/changelog/2026…

@minseosongx @MattIPv4 merged!

@MattIPv4 @dependabot saw the word bug and sprinted over but i only know about the six legged kind. hope your pr gets merged soon

@dependabot, now that y'all are back on here, who can I bug to help get github.com/dependabot/dep… landed, to fix github.com/dependabot/dep…? The PR has been sitting open + approved for a couple of months now...

@chris98822 @shub0414 Enable push protection so it doesn't happen again🤫

@shub0414 Use dependabot.

You accidentally pushed production credentials to GitHub. Tech Lead: Delete the commit. Security Engineer: Delete the credentials. What's the first thing you do?

Dependabot just got better at using private npm registries!

@MattIPv4 On it!

@MattIPv4 We are on it 🫡

@dependabot Y'all, this appears to have broken things... github.com/dependabot/dep…

See ya never, PATs! github.blog/changelog/2026…

See ya never, Python 3.9! github.blog/changelog/2026…

As foreshadowed... github.blog/changelog/2026…

We're excited to announce Christopher Golda (@golda) and Grey Baker (@greybaker) as YC's newest General Partners! Chris co-founded BackType (S08), sold it to Twitter, then built their entire ad business from zero to $1B+ in revenue. Grey co-founded Dependabot, a developer tool a million engineers rely on every single day— and sold it to GitHub. Then he co-founded Pincites (S23), which was acquired by Filevine. As Visiting Partners, both have already spent multiple batches working closely with founders. Now they're doing it full-time. ycombinator.com/blog/chris-gol…

If we shipped version update cooldowns as a default, would you want it on, and what should the default be?

Jalen Brunson is the Dependabot of the NBA

@anelgarhy @renovatebot ruh roh. is your repo public? drop a link if so

for some reason @dependabot and @renovatebot just stopped indexing my new repos automatically, and now I have to update my dependencies manually :(

Dependabot now supports Deno 🚀 Add package-ecosystem: "deno" to your dependabot.yml and start getting automated dependency update PRs. Nice addition from @GitHub @deno_land

@komorebi_ai @matteocollina GitHub Advanced Security has SAST (Code Scanning), Secret Protection, and SCA (Dependabot)! docs.github.com/en/get-started…

@matteocollina Is Github Security the same thing as Dependabot alerts?

One of the worst decisions I made in the past was handling security reporting via GitHub Security. It keeps 500s on me :(. It was working good with low traffic, but AI/high traffic has made it very hard to work with.

Just published an episode about Nix support in Dependabot with Ankit Kumar Honey, senior engineering manager at GitHub, working on the Dependabot ecosystem, and Jamie Magee, principal software engineer at Microsoft, focusing on open source software and supply chain security, who contributed the Dependabot Nix support recently. Bump bump bump. fulltimenix.com/episodes/depen…

@deno_land happy to have you in Dependabot version updates! github.blog/changelog/2026…

new ecosystem dropping soon 👀

@djco On it 👀

@dependabot Can we finally get this merged? github.com/dependabot/dep…

It's been a minute, but I'm back on X, and I'll be around here more often. See you in the tags and comments!!

@github I'll be there, you can depend on it!

Come October 28–29 you'll wish you were here. Save future you from FOMO. GitHub Universe Super Early Bird is here. Get $600 off now until July 8. githubuniverse.com/?utm_source=Tw…