Dependabot and security advisories: tame the update flood

Problem

Dependencies change faster than a small team can review them. Left alone, Dependabot opens a pull request per package, reviewers stop looking, and updates either pile up unmerged or get approved on autopilot. Both outcomes are dangerous. The first leaves known vulnerabilities in place. The second lets a bad release in with a rubber stamp.

The risk is real and it is not limited to libraries. In March 2025, the widely used GitHub Action tj-actions/changed-files was compromised: attackers pointed existing version tags at malicious code that printed secrets into workflow logs, and CISA added the issue to its Known Exploited Vulnerabilities catalog. Workflows that referenced a tag, not a commit, picked up the malicious code without anyone changing a line. The lesson applies to every ecosystem: what you depend on, and how you pin it, is part of your attack surface.

Options and trade-offs

• Individual update pull requests: easy to review in isolation, and noisy enough that reviewers fatigue.
• Grouped updates: Dependabot batches related updates into one pull request. Fewer pull requests, slightly larger diffs, and better reviewer throughput.
• Auto-merge for low-risk updates: fast, and only safe where tests are good. Limit it to patch releases or development-only dependencies.
• Code owners on sensitive paths: guarantees someone accountable reviews changes to build files, workflows and security code. It adds latency where it matters.
• Security advisories: Dependabot alerts tell you what is vulnerable. Repository security advisories let you coordinate a fix privately before disclosure, which matters if you maintain a library others depend on.
• Pinning actions by tag versus by commit SHA: tags are readable and movable, and SHAs are immutable. Dependabot can keep SHA pins current.

My recommendation

Group routine minor and patch updates into one weekly pull request per ecosystem. Auto-merge only patch updates, and only when the required checks pass. Keep major versions and anything touching build or workflow files manual and owner-reviewed. Pin third-party GitHub Actions to full commit SHAs, and let Dependabot raise the update pull requests. Treat security alerts separately from routine updates, with their own faster path.

Minimal working example

The Dependabot configuration, covering a Gradle project and the workflows themselves:

# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: "gradle"
    directory: "/"
    schedule:
      interval: "weekly"
      day: "monday"
    open-pull-requests-limit: 5
    groups:
      minor-and-patch:
        update-types: ["minor", "patch"]
    labels: ["dependencies"]

  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"
    groups:
      actions:
        patterns: ["*"]
    labels: ["dependencies", "ci"]

Auto-merge for patch updates only, using Dependabot's own metadata action:

# .github/workflows/dependabot-automerge.yml
name: dependabot-automerge
on: pull_request

permissions:
  contents: write
  pull-requests: write

jobs:
  automerge:
    if: github.actor == 'dependabot[bot]'
    runs-on: ubuntu-latest
    steps:
      - id: meta
        uses: dependabot/fetch-metadata@v2
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Enable auto-merge for patch updates
        if: steps.meta.outputs.update-type == 'version-update:semver-patch'
        run: gh pr merge --auto --squash "$PR_URL"
        env:
          PR_URL: ${{ github.event.pull_request.html_url }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Auto-merge waits for the required checks configured in your ruleset or branch protection, so make sure they exist. Without them, "auto-merge when checks pass" merges immediately.

Owners for the files that control your build and your supply chain:

# .github/CODEOWNERS
/.github/              @my-org/security
/build.gradle*         @my-org/maintainers
/gradle/               @my-org/maintainers
/.github/dependabot.yml @my-org/security

Pin an action by commit SHA, with a readable comment that Dependabot updates along with the SHA:

- uses: actions/checkout@<full-40-character-commit-sha>  # v4.x.x

Test it: let Dependabot open a grouped pull request, confirm a patch-only update merges after checks pass, confirm a major update waits for review, and confirm a change to the workflows folder asks for the security group.

Checklist

• Enable Dependabot version updates and alerts, and keep security updates on.
• Group minor and patch updates per ecosystem, and cap open pull requests.
• Restrict auto-merge to patch updates with passing required checks.
• Make sure required checks exist before enabling auto-merge.
• Add CODEOWNERS for build files, workflows and the Dependabot config.
• Pin third-party actions to full commit SHAs.
• Enable private vulnerability reporting if you maintain a public library, and use repository security advisories to coordinate fixes.
• Write the triage rule down: who looks at a security alert, within what time, and what counts as done.

Where this doesn't apply

Projects with frozen or vendored dependencies see few updates and may not need grouping. Ecosystems governed by an external policy engine or an internal mirror may enforce these rules elsewhere.

One honest limitation

Grouping reduces noise, but it can also hide an interaction: one risky update buried in a batch of ten harmless ones. Keep majors and anything touching sensitive paths out of the groups, and read the lockfile diff when it matters.

Sources

• Dependabot options reference — https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference
• Automating Dependabot with GitHub Actions — https://docs.github.com/en/code-security/dependabot/working-with-dependabot/automating-dependabot-with-github-actions
• About code owners — https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
• About repository security advisories — https://docs.github.com/en/code-security/security-advisories/working-with-repository-security-advisories/about-repository-security-advisories
• CISA alert on the tj-actions/changed-files compromise — https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-tj-actionschanged-files-cve-2025-30066-and-reviewdogaction