GitHub
Code quality
Security & compliance
No Dependabot config — dependency updates not automated
Part of the Release & branch safety check · fix arrives as a pull request
What it is
The repository has no Dependabot (or equivalent) configuration, so dependency updates are not proposed automatically.
Why it matters
Updates then happen when someone remembers, which in practice means when something breaks. Security patches sit unapplied for months because nothing surfaces that they exist.
How to fix it
Add .github/dependabot.yml covering your package ecosystems and GitHub Actions, and group patch updates so the volume stays reviewable rather than becoming noise people close unread.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.