Glossary term
What is Dependabot? Meaning for developers
A GitHub bot that raises alerts and opens pull requests to update vulnerable or old dependencies.
Learn it properly · Security for DevelopersLesson 6: Dependencies and the Supply Chain: npm, Lockfiles and GitHub ActionsHow a package you did not write can hurt you: typosquatting, install scripts, malicious updates. Lockfiles, npm audit, Dependabot, secret scanning and securing your CI.