Dependabot-Core is a library that generates automated pull requests updating dependencies across multiple programming languages and package managers.
The tool solves the problem of keeping project dependencies current and secure by automating the detection of available updates and the creation of pull requests with resolved dependency changes. It works by checking for the latest resolvable version of each dependency given a project's constraints, generating updated manifest and lockfiles, and composing pull request descriptions that include changelogs, release notes, and commit information. The library supports Ruby, JavaScript, Python, PHP, Dart, Elixir, Elm, Go, Rust, Java, Julia, and .NET projects, along with git submodules, Docker files, Terraform, Opentofu, and Pre-Commit hooks.
Developers should adopt this tool if they need to run a custom or self-hosted version of Dependabot rather than relying on GitHub's hosted service. It suits organizations that want to integrate dependency updates into their own platforms or CI systems, or those running repositories on alternative hosting services. The tool currently supports pull request creation against GitHub, GitHub Enterprise, Azure DevOps, GitLab, Bitbucket, and AWS CodeCommit. The README recommends the open-source Dependabot CLI as the primary entrypoint for standalone use cases.
The project maintains a substantial base of external adopters, with almost all open issues raised by outside users rather than the core team. Maintainers typically respond to new issues and pull requests within a few days. Work in the issue tracker is dominated by bug reports and feature requests, with particular attention to JavaScript ecosystem support.
