dependabot/dependabot-core

Dependabot-Core is the engine behind Dependabot, the automated dependency updater built into GitHub. When you enable Dependabot on a repository, it scans your project files for outdated packages, figures out which new version works given all the other things your project depends on, and then opens a pull request with the necessary file changes. This repository is the Ruby library that performs all of that logic. The library supports a wide range of programming ecosystems: Ruby, JavaScript, Python, PHP, Dart, Elixir, Elm, Go, Rust, Java, Julia, and .NET. It can also update Docker files, Terraform and OpenTofu infrastructure files, Git submodules, and pre-commit hook versions. When it creates a PR, it automatically pulls in the changelogs, release notes, and commit history for the updated package so reviewers have context. Most developers interact with Dependabot through GitHub's hosted service, where you simply add a configuration file to your repository. But this codebase also allows you to run Dependabot yourself on other platforms, including GitHub Enterprise, GitLab, Azure DevOps, Bitbucket, and AWS CodeCommit. The recommended way to do that is through a separate open-source command-line tool called the Dependabot CLI, which generates dependency diffs that you can then wire up to create pull requests on your own. For people who want to work on the code itself, the README describes a Docker-based development environment that includes all required language runtimes and tools. There are instructions for writing dry-run tests against real repositories, debugging update logic, running the test suite, and contributing support for entirely new package ecosystems. The project is maintained by GitHub.