GitHub’s Dependabot has been a lifeline for countless organizations. On paper, Dependabot is a powerful security feature, automatically detecting and updating vulnerable dependencies across your repositories. But here’s the problem: without proper configuration, Dependabot often creates more noise than value. Engineering teams get inundated with sporadic, unpredictable updates that break builds, while security teams remain blind to critical dependency vulnerabilities that need immediate attention.

For organizations without GitHub Advanced Security—which can cost tens of thousands of dollars annually—getting Dependabot to work effectively has been a manual, time-consuming process that requires ongoing maintenance across potentially hundreds of repositories. Even worse, recent changes to GitHub’s platform removed key features like automatic reviewer assignment, leaving security teams out of the loop on critical security updates.

This is where Red Canary’s newest open source tool comes in. Dependabot Configurator solves the fundamental challenges that make Dependabot difficult to use in practice, while ensuring security teams get the visibility and control they need to protect their organizations.

Visit the Dependabot Configurator GitHub page for code and implementation instructions to help secure your organization’s repositories.

The Dependabot problem: Great in theory, painful in practice

GitHub’s Dependabot promises automated dependency management, but the reality is often frustrating for both engineering and security teams. Here’s what we consistently see at Red Canary:

Unpredictable update chaos

Without proper configuration, Dependabot updates arrive sporadically and unpredictably. One day you might get five dependency update PRs, the next day none, then suddenly fifteen all at once. This makes it impossible for teams to plan and allocate time for reviewing updates.

Transitive dependency nightmares

By default, Dependabot updates both direct and transitive dependencies. While this sounds comprehensive, it often leads to complex compatibility issues where updating a transitive dependency breaks the primary dependency, creating builds that are impossible to fix without deep dependency tree knowledge.

Security updates lost in the noise

Critical security updates get buried alongside routine version bumps, making it difficult for security teams to prioritize what actually matters for organizational risk.

Configuration overhead scales poorly

Setting up optimal Dependabot configurations for each repository is time-consuming and requires ongoing maintenance as package managers change. For organizations with dozens or hundreds of repositories, this becomes an impossible maintenance burden.

No security team visibility

Without GitHub Advanced Security, there’s no built-in way to ensure security teams are notified about critical dependency vulnerabilities. Security updates get treated the same as routine maintenance, leaving security teams in the dark about risks that could impact the entire organization.

As a result of these challenges, many engineering teams simply disable Dependabot or ignore its alerts entirely, missing out on important security updates and leaving their organizations vulnerable to known exploits.

Why did I build Dependabot Configurator in the first place?

Simply put, I developed Dependabot Configurator because I needed a way to make dependency management actually work for both the engineering and security teams at scale at Red Canary, without purchasing yet another expensive tool that requires tuning. Dependencies represent one of the largest attack surfaces in modern applications, and Red Canary’s Product Security team needed a way to manage this risk effectively.

Dependencies in code repositories represent one of the largest attack surfaces in modern applications.

We knew that Dependabot had the potential to be incredibly valuable, but the default experience was too noisy and unpredictable for engineering teams, while providing no visibility for security teams. After poring through Dependabot’s documentation, I realized that if we were going to go forward with Dependabot as a solution for third-party open source package management, I would need to build an automated solution that made it possible for product teams to configure what they care about while ensuring all the security features I care about are protected.

Requirements

My requirements for Dependabot Configurator were strict. I wanted the tool to:

•   Automatically detect package managers across repositories and generate appropriate configurations.
•   Focus on direct dependencies to avoid the complexity and instability of transitive updates.
•   Separate security updates from version updates with different handling for each.
•   Ensure security team visibility through automated reviewer assignment and labeling.
•   Group updates predictably so teams can plan time for dependency reviews.
•   Scale effortlessly across organizations with hundreds of repositories.
•   Require minimal setup, with just two files to get started.
•   Protect against supply chain attacks by pinning GitHub Actions with SHA256.

Better dependency management through automation

Let’s walk through a real-world example of how Dependabot Configurator transforms the dependency management experience. Consider a typical organization with 50 repositories using various package managers: npm, pip, Docker, Maven, and others. Without Dependabot Configurator, setting up proper dependency management would require:

Manual configuration for each repository (hours per repository)

•   Analyzing which package managers are in use
•   Reading Dependabot documentation
•   Creating appropriate Dependabot configuration entries
•   Setting up ignore rules for problematic dependencies
•   Configuring schedules and PR limits
•   Testing the configuration and iterating

Ongoing maintenance

•   Adding new package managers as they’re introduced
•   Adjusting ignore rules as dependencies change
•   Managing configuration drift across repositories
•   Troubleshooting broken builds from problematic updates

In total, this represents hundreds of hours of initial setup and many hours of monthly maintenance—an impossible burden for most teams.

How Dependabot Configurator streamlines this process

With Dependabot Configurator, the same organization simply:

1. Copies two files to each repository (5 minutes per repository)
2. Runs the configurator weekly via GitHub Actions (fully automated)
3. Reviews and merges the generated configuration updates (less than 5 minutes per repository per month)

The configurator automatically:

•    Scans repositories to detect all package managers in use
•    Generates optimized configurations with appropriate schedules and grouping
•    Applies ignore rules from a simple YAML file
•    Creates security reviewer workflows that ensure security teams are notified of security updates
•    Pins GitHub Actions to specific SHA256 hashes for improved security
•    Updates configurations as repositories evolve

The security team visibility challenge

One of the most critical problems Dependabot Configurator solves is the lack of visibility into dependency vulnerabilities. This challenge became even more acute when GitHub recently removed the reviewers field from Dependabot’s configuration, breaking many organizations’ security review processes.

The reviewer removal problem

Previously, organizations could configure Dependabot to automatically assign security teams as reviewers on security update PRs: