{"slug": "dependabot", "name": "Dependabot", "category": "other", "category_name": "Other software", "description": "", "recommenders": 1, "commenters": 4, "warners": 1, "score": 0.587, "rising": -0.33, "first": "2025-11-23", "latest": "2026-07-30", "why": "I love bots like Renovate and Dependabot for taking care of updating my projects' dependencies.", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 1, "neutral": 1, "compare": 1, "warn": 1}, "spark": [0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0], "listed": false, "loved": [], "caveat": "", "short_quote": "I love bots like Renovate and Dependabot for taking care of updating my projects' dependencies.", "icon": false, "domain": null, "github_repo": null, "official_url": "", "pricing": "", "aliases": ["Dependabot"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 785747954, "item_id": 49109247, "url": "https://news.ycombinator.com/item?id=49109247", "by": "mxmehl", "date": "2026-07-30", "stance": "recommend", "quote": "I love bots like Renovate and Dependabot for taking care of updating my projects' dependencies.", "excerpt": "I love bots like Renovate and Dependabot for taking care of updating my projects' dependencies. But I hate when bumped dependencies break things, especially if it's the same version update across multiple projects! OK, there are email notifications, but it's a hell of a noise if you're maintaining projects on multiple platforms (GitHub, GitLab, Gitea, ...) in different contexts (personal, work, volunteering, ...). So", "context": "", "use_case": "dependency updates", "switched_from": "", "story": "PRoctr \u2013 doctor/triage for your renovate/dependabot PRs"}]}], "caveats": [{"label": "", "summary": "", "quotes": [{"id": 736417200, "item_id": 46026075, "url": "https://news.ycombinator.com/item?id=46026075", "by": "time4tea", "date": "2025-11-23", "stance": "warn", "quote": "endless dependabot PRs with no understanding of the reason or impact, bad.", "excerpt": "Been saying this for years! All the security theatre! False urgency is red flag when it comes to emails and sms.. I dont see why people don't see the same when it comes to dependency alerts. The vast vast majority of alerts are totally useless, when it comes to your actual deployed system, unexploitable and irrelevant. Rushing to update causes make-work, churn and loss of focus on the real. Don't get me wrong, I love", "context": "", "use_case": "dependency update alerts", "switched_from": "", "story": "We should all be using dependency cooldowns"}]}], "who": [], "tags": [], "use_cases": ["dependency updates", "dependency update alerts"], "compared": [{"slug": "renovate", "name": "Renovate", "co": 3, "switched_from": 0, "switched_to": 0}, {"slug": "govulncheck", "name": "govulncheck", "co": 2, "switched_from": 0, "switched_to": 0}], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=49109246", "title": "PRoctr \u2013 doctor/triage for your renovate/dependabot PRs", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=48882730", "title": "Fable extended until 19 July", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47094192", "title": "Turn Dependabot Off", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=46005111", "title": "We should all be using dependency cooldowns", "mentions": 1}], "sentiment_by_month": {"2025-11": {"warn": 1}, "2025-12": {}, "2026-01": {}, "2026-02": {"compare": 1}, "2026-03": {}, "2026-04": {}, "2026-05": {}, "2026-06": {}, "2026-07": {"neutral": 1, "recommend": 1}, "2026-08": {}, "2026-09": {}, "2026-10": {}}, "quotes": [{"id": 785747954, "item_id": 49109247, "url": "https://news.ycombinator.com/item?id=49109247", "by": "mxmehl", "date": "2026-07-30", "stance": "recommend", "quote": "I love bots like Renovate and Dependabot for taking care of updating my projects' dependencies.", "excerpt": "I love bots like Renovate and Dependabot for taking care of updating my projects' dependencies. But I hate when bumped dependencies break things, especially if it's the same version update across multiple projects! OK, there are email notifications, but it's a hell of a noise if you're maintaining projects on multiple platforms (GitHub, GitLab, Gitea, ...) in different contexts (personal, work, volunteering, ...). So", "context": "", "use_case": "dependency updates", "switched_from": "", "story": "PRoctr \u2013 doctor/triage for your renovate/dependabot PRs"}, {"id": 782141875, "item_id": 48883867, "url": "https://news.ycombinator.com/item?id=48883867", "by": "Leynos", "date": "2026-07-12", "stance": "neutral", "quote": "enabling dependabot automerge", "excerpt": "The sort of thing Fable and Sol excel at are long horizon tasks. The sort of thing I have been using them for is migrating large numbers of repositories to new tooling simultaneously (adopting new linters, enabling dependabot automerge, rolling out mutation testing). Some of that can be done mechanically or trivially, and Fable knows to write a script or deploy Sonnet for those instances, but other times there are co", "context": "", "use_case": "dependency updates", "switched_from": "", "story": "Fable extended until 19 July"}, {"id": 753526834, "item_id": 47095427, "url": "https://news.ycombinator.com/item?id=47095427", "by": "adamdecaf", "date": "2026-02-20", "stance": "compare", "quote": "renovate[bot] (similar to dependabot)", "excerpt": "govulncheck is the much better answer and we use it. We also let renovate[bot] (similar to dependabot) merge non-major dep updates if tests pass. I hardly notice when deps have small updates. https://github.com/search?q=org%3Amoov-io+is%3Apr+is%3Amerged+sort%3Anewest+author%3Arenovate%5Bbot%5D&type=pullrequests&s=created&o=desc", "context": "", "use_case": "dependency updates", "switched_from": "", "story": "Turn Dependabot Off"}, {"id": 736417200, "item_id": 46026075, "url": "https://news.ycombinator.com/item?id=46026075", "by": "time4tea", "date": "2025-11-23", "stance": "warn", "quote": "endless dependabot PRs with no understanding of the reason or impact, bad.", "excerpt": "Been saying this for years! All the security theatre! False urgency is red flag when it comes to emails and sms.. I dont see why people don't see the same when it comes to dependency alerts. The vast vast majority of alerts are totally useless, when it comes to your actual deployed system, unexploitable and irrelevant. Rushing to update causes make-work, churn and loss of focus on the real. Don't get me wrong, I love", "context": "", "use_case": "dependency update alerts", "switched_from": "", "story": "We should all be using dependency cooldowns"}]}