dependabot / dependabot-core

Welcome to the public home of Dependabot :dependabot:.
# Table of Contents
- What is Dependabot-Core?
- How to run Dependabot
- Contributing to Dependabot
 - Reporting Issues and Feature Requests
 - Submitting Pull Requests
 - New Ecosystems
- Development Guide
 - Getting a Development Environment Running
 - Debugging Problems
 - Running Tests
 - Profiling
- Architecture and Code Layout
- Trademarks
- Notes for Project Maintainers
---
# What is Dependabot-Core?
Dependabot-Core is the library at the heart of Dependabot security / version updates.
Use it to generate automated pull requests updating dependencies for projects written in Ruby, JavaScript, Python,
PHP, Dart, Elixir, Elm, Go, Rust, Java, Julia, and .NET. It can also update git submodules, Docker files, Opentofu, Terraform files and Pre-Commit hooks.
Features include:
- Check for the latest version of a dependency *that's resolvable given a project's other dependencies*
- Generate updated manifest and lockfiles for a new dependency version
- Generate PR descriptions that include the updated dependency's changelogs, release notes, and commits
# How to run Dependabot
Most people are familiar with the Dependabot service that runs on GitHub.com and GitHub Enterprise. Enabling that is as
simple as checking a `dependabot.yml` configuration file in to your repository's `.github` directory.
However, if you want to run a custom version of Dependabot or run it on another platform, you're not left out in the cold.
This repo provides the logic necessary for hosting your own standalone Dependabot. It currently supports opening Pull Requests against repositories hosted on GitHub, Github Enterprise, Azure DevOps, GitLab, BitBucket, and AWS CodeCommit.
Dependabot-Core is a library, so you'll need an entrypoint script of some kind. Here are a few examples to help you get
started.
>**Note:** If you're looking to run Dependabot locally for development/debugging purposes, see the Development Guide.
## Dependabot CLI
The open-source Dependabot CLI is our recommended entrypoint for standalone use cases.
We use it in production here at GitHub, and advanced users can also leverage it to run a self-hosted version of Dependabot within their own projects / CI systems.
It creates dependency diffs but does not create PRs. So you will need to wire that up yourself.
To aid with that, we created the example-cli-usage repo which demonstrates how to turn those diffs into actual PR's.
## Write your own Ruby-based tool
Alternatively, because Dependabot-Core is a Ruby library, you can write your own ruby-based wrapper that leverages the Dependabot-core code. The tricky bit is Dependabot assumes it's running in an isolated, throw-away environment so you'll need to handle all that yourself. For example protecting against security risks of arbitrary code execution exfiltrating credentials, ensuring the appropriate version of Go or Python or whatever language you need is available, and handling when Dependabot makes changes to