Dependabot

by GitHub · San Francisco, United States · Since 2017

Dependency updates.

Starting price: Free — included with GitHub; Dependabot has no price of its own; GitHub's pricing page lists Dependabot security and version updates as included on the Free plan and above
Free trial / plan: Free on every GitHub plan; Included on GitHub Free ($0/month), GitHub Team and GitHub Enterprise — and running it does not consume your GitHub Actions minutes
Deployment: Cloud; Web
App Advisor rating: 4.4; transparency & India fit

What is Dependabot?

Dependabot is free and built into GitHub. It is not a separate product you buy — it is included on every GitHub plan, starting with the free one, and there is no Dependabot price list.

It does three things: alerts you when a dependency has a known vulnerability, opens pull requests to patch those vulnerabilities (security updates), and opens pull requests to keep dependencies current even when they are not vulnerable (version updates).

GitHub's own pricing page lists Dependabot security and version updates as included on the Free plan, alongside Team and Enterprise.

Dependabot runs on GitHub Actions, but GitHub's billing documentation explicitly states that use of standard GitHub-hosted runners is free for Dependabot — so it does not eat your Actions minutes.

What works well

+Free on every GitHub plan including the free one — there is no procurement conversation to have.
+Zero setup for alerts and security updates; version updates need only one YAML file.
+Does not consume your GitHub Actions minutes, per GitHub's own billing documentation.
+Backed by the GitHub Advisory Database, so vulnerability data is maintained for you.
+Lives where your code already is — updates arrive as ordinary pull requests through your normal review process.
+Alerts can be handed to an AI coding agent to produce a proposed fix as a draft pull request.

What to watch out for

−GitHub-only. If your code is on GitLab, Bitbucket or self-hosted Git, Dependabot is not an option.
−Version updates can generate a high volume of pull requests, which teams often end up ignoring — the 3-day cooldown default helps but does not solve it.
−It updates dependencies; it does not tell you whether your code actually calls the vulnerable function, so alert noise on transitive dependencies is common.
−Unlike commercial SCA tools, it does not offer licence compliance analysis or a full software bill of materials workflow.
−The rest of GitHub's security suite is not as generous — code scanning, secret scanning and CodeQL are public-repos-only on Free and Team.

Best suited for: Any team already hosting code on GitHub — there is no reason not to turn it on · Small teams and Indian startups who need supply-chain security with no budget · Open-source maintainers keeping dependencies current across many repositories · Teams that want vulnerability patches to arrive through the normal pull-request review flow

AI analysis of Dependabot

Analysing Dependabot — pricing, features, reviews and alternatives…

Generated by App Advisor's native engine from this listing's verified data — not a paid placement.

Dependabot features

Researched from Dependabot's official product pages · updated September 2026.

Dependabot alerts

Notifies you about dependencies with known security vulnerabilities
Scans your repository's default branch
Matches against the GitHub Advisory Database
Alerts can be assigned to AI agents such as Copilot or Claude (when enabled), which can create a session and open a draft pull request with a proposed fix

Dependabot security updates

Automatically opens pull requests that upgrade vulnerable dependencies to secure versions
Driven by the same GitHub Advisory Database data as alerts
Included on the GitHub Free plan

Dependabot version updates

Automated pull requests that keep dependencies current even when there is no vulnerability
Configured by checking a dependabot.yml file into the repository
The config file tells Dependabot where your manifest and package definition files are
Supports a cooldown period before considering new releases, defaulting to 3 days
Also keeps GitHub Actions used in your workflows up to date
Included on the GitHub Free plan

Configuration and control

Single dependabot.yml file checked into the repository
Per-ecosystem and per-directory configuration
Cooldown settings to avoid chasing brand-new releases
Covered by GitHub's Terms of Service like any other GitHub feature

AI capabilities

Dependabot alerts can be assigned to AI agents such as Copilot or Claude, when enabled. GitHub's documentation states these agents can automatically create a session and open a draft pull request with a proposed fix.
This is a GitHub platform capability layered on Dependabot, and the availability of the AI agent itself depends on your GitHub Copilot or agent entitlement, which is priced separately from Dependabot.

Dependabot pricing (USD)

Source

Every edition as published by the vendor. Prices exclude GST unless stated. Full Dependabot pricing breakdown

GitHub Free

per month

Dependabot security and version updates included
Unlimited public and private repositories
2,000 CI/CD minutes/month (free for public repos)
500MB Packages storage (free for public repos)
Community support
Secret scanning, code scanning, push protection and CodeQL are public-repos-only on this plan

GitHub Team

per user/month (GitHub's pricing page shows this as a first-12-months rate)

Dependabot included
Everything in Free
GitHub Codespaces access
3,000 CI/CD minutes/month
2GB Packages storage
Repository rules and advanced code review

GitHub Enterprise

From $21

per user/month (GitHub's pricing page shows this as a first-12-months starting rate)

Dependabot included
Everything in Team
50,000 CI/CD minutes/month
50GB Packages storage
Full secret scanning, code scanning, push protection and CodeQL on private repos
SAML SSO and audit logging
Data residency options
Premium support available

Other pricing options & add-ons

• Dependabot does not cost money. GitHub's pricing page lists Dependabot security and version updates under the Free plan, and the same feature appears on Team and Enterprise.
• The plan prices listed are GitHub's plan prices, not Dependabot's. They are included here only because 'is Dependabot free' is really a question about which GitHub plan you need — and the answer is any of them, including the free one.
• GitHub's Actions billing documentation states that the use of standard GitHub-hosted runners is free for Dependabot, so Dependabot runs do not consume your monthly Actions minutes.
• GitHub Actions is separately free for public repositories, self-hosted runners and GitHub Pages; beyond included quotas, Actions overage rates are $0.006/min for Linux, $0.010/min for Windows and $0.062/min for macOS — these apply to your own workflows, not to Dependabot's runs.
• The Team and Enterprise figures on GitHub's pricing page are presented as first-12-months rates, so confirm the ongoing renewal rate with GitHub before budgeting multi-year.
• freeTrial is null because there is nothing to trial — the feature is free.
• Note the contrast with GitHub's other security features: code scanning, secret scanning, push protection and CodeQL are public-repos-only on Free and Team, and fully available on private repos only on Enterprise. Dependabot is the exception that is available everywhere.

Buying for a team? App Advisor can get you a volume quote and any partner discount available.

Implementing Dependabot

Source

Ways to implement

Enable Dependabot alerts and security updates in repository or organisation security settings
Add a dependabot.yml file for version updates

Alerts and security updates are a settings toggle. Adding version updates is a single configuration file. GitHub does not publish an implementation timeline, so none is quoted.

1Turn on Dependabot alerts for the repository or across the organisation
2Turn on Dependabot security updates so vulnerable dependencies get patch pull requests automatically
3Add a dependabot.yml file at .github/dependabot.yml to enable version updates
4In that file, declare each package ecosystem and the directory containing its manifest
5Set a cooldown if you do not want pull requests the moment a release lands (the default is 3 days)
6Include the github-actions ecosystem so your workflow actions stay updated too
7Set grouping and scheduling deliberately, or the pull-request volume will overwhelm reviewers
8Confirm CI runs on Dependabot pull requests so you can merge with confidence

Need a certified partner in India to set up Dependabot?Implementation help

Integrations, security & India

Integrations

Native to GitHub — repositories, pull requests, security settings and the Advisory Database
GitHub Actions, both as an update target (keeping your workflow actions current) and as the execution mechanism (free on standard GitHub-hosted runners)
AI coding agents such as Copilot or Claude for assigned alerts, when enabled

Security & compliance

Backed by the GitHub Advisory Database for vulnerability data
Scans the repository's default branch for vulnerable dependencies
Runs inside GitHub, so no third-party service needs access to your source code
Complements, rather than replaces, code scanning, secret scanning and CodeQL — note those are public-repos-only on the Free and Team plans

For Indian businesses

There is no India-specific billing question for Dependabot itself, because it costs nothing on any GitHub plan.
If you are paying for GitHub Team or Enterprise, that purchase is made from GitHub (Microsoft) in USD. We did not verify INR billing or GST invoicing arrangements for GitHub plans on the pages fetched, so no claim is made — check with GitHub or your Microsoft reseller if you need a GST input-tax-credit invoice. Many Indian enterprises buy GitHub through a Microsoft enterprise agreement or local reseller, which is usually the practical route to INR billing and a GST invoice.
Data residency options are listed on the GitHub Enterprise plan; we did not verify whether an India region is among them, so no residency claim is made.
For Indian startups and student teams, the key point is that supply-chain vulnerability alerting and automated patch pull requests cost nothing at all on GitHub Free, including on private repositories.
Support hours follow your GitHub plan; there are no published India-local hours.

Support, resources & partner network

Support & learning

Supported as part of GitHub, so support follows your GitHub plan: community support on Free, web-based support on Team, and premium support available on Enterprise
Dependabot and all related features are covered by GitHub's Terms of Service
No Dependabot-specific SLA exists separately from GitHub's

GitHub pricing (shows Dependabot on the Free plan)About Dependabot alerts About Dependabot version updates GitHub Actions billing (states runners are free for Dependabot)

Is Dependabot the best choice for you?

Best choice if you are…

Any team already hosting code on GitHub — there is no reason not to turn it on
Small teams and Indian startups who need supply-chain security with no budget
Open-source maintainers keeping dependencies current across many repositories
Teams that want vulnerability patches to arrive through the normal pull-request review flow

Look elsewhere if you are…

Teams not using GitHub
Organisations needing licence compliance or full SBOM governance, which Dependabot does not provide
Teams wanting reachability analysis to tell them whether a flagged vulnerability is actually exploitable in their code
Anyone expecting it to replace a full application security programme — it covers dependencies only

Still comparing? Get an unbiased shortlist and demos arranged for free.

Sources (4) · updated September 2026

Specifications

Category: DevOps, CI/CD & monitoring
Vendor: GitHub
Headquarters: San Francisco, United States
Founded: 2017
Pricing model: Free
Starting price: Free
Deployment: Cloud
Platforms: Web
Best for: Startup, Small business, SMB
Made in India: No

Free plan

View

Compare all Dependabot alternatives with pricing →

Dependabot — frequently asked questions

Is Dependabot free?+

Yes. Dependabot is free and built into GitHub — it is not a separate product. GitHub's pricing page lists Dependabot security and version updates as included on the GitHub Free plan ($0/month), as well as on Team and Enterprise. There is no Dependabot licence, subscription or add-on to buy.

Does Dependabot cost money?+

No. Dependabot itself costs nothing on any GitHub plan, including the free one, and that includes private repositories. The only money involved is whatever you already pay GitHub for your plan, and Dependabot does not add to it.

What is Dependabot pricing?+

There is no Dependabot pricing, because Dependabot is not sold separately. It is a GitHub feature included on every plan. GitHub's own plan prices are $0/month for Free, $4/user/month for Team and from $21/user/month for Enterprise (the Team and Enterprise figures are shown as first-12-months rates), but Dependabot is included at every one of those tiers.

Does Dependabot use my GitHub Actions minutes?+

No. Dependabot runs on GitHub Actions, but GitHub's Actions billing documentation explicitly states that the use of standard GitHub-hosted runners is free for Dependabot. So Dependabot's own runs do not consume your monthly Actions quota, regardless of repository visibility. Your own CI workflows that run on Dependabot's pull requests do consume minutes in the normal way.

What is the difference between Dependabot alerts, security updates and version updates?+

Alerts notify you that a dependency has a known vulnerability, matched against the GitHub Advisory Database by scanning your default branch. Security updates go a step further and automatically open pull requests upgrading those vulnerable dependencies to secure versions. Version updates are broader still — automated pull requests that keep dependencies current even when they have no vulnerabilities, configured through a dependabot.yml file.

How do I enable Dependabot version updates?+

You check a dependabot.yml configuration file into your repository, normally at .github/dependabot.yml. The file specifies where your manifest and package definition files live so Dependabot can identify outdated dependencies. You can also set a cooldown period before Dependabot considers a new release, which defaults to 3 days.

Does Dependabot work on private repositories for free?+

Yes — GitHub's pricing page lists Dependabot security and version updates on the Free plan, which itself includes unlimited public and private repositories. This is notably more generous than GitHub's other security features: code scanning, secret scanning, push protection and CodeQL are limited to public repositories on the Free and Team plans and only fully available on private repos with Enterprise.

Can Dependabot fix vulnerabilities automatically with AI?+

Partly. Dependabot security updates already open pull requests that bump vulnerable dependencies to safe versions without any AI. Separately, GitHub documents that Dependabot alerts can be assigned to AI agents such as Copilot or Claude when enabled, and those agents can create a session and open a draft pull request with a proposed fix. The AI agent entitlement is priced separately from Dependabot, which remains free.

What is Dependabot?+

Dependabot is devops, ci/cd & monitoring by GitHub. Dependency updates.

How much does Dependabot cost?+

Dependabot is free to use.

Does Dependabot offer a free trial or free plan?+

Yes — Dependabot offers a free plan you can start with.

Is Dependabot made in India?+

No. Dependabot is developed by GitHub in San Francisco, United States, though it is used by Indian businesses.

Who is Dependabot best suited for?+

Dependabot suits startup, small business, smb buyers looking for devops, ci/cd & monitoring.

What are the best alternatives to Dependabot?+

Popular alternatives in devops, ci/cd & monitoring include Site24x7, ManageEngine Applications Manager, ManageEngine OpManager. Use App Advisor's compare tool to see them side by side.

How is Dependabot deployed?+

Dependabot is available as a cloud (SaaS) product, with web access.