Dependabot is GitHub automation that monitors a repository’s dependencies and opens pull requests when newer versions are available. It is not a malware scanner; it is an update workflow that reads package metadata, compares versions, and proposes changes for review.
In cyber security, Dependabot matters because dependency updates are a common supply-chain risk. Attackers may publish a malicious package, compromise a maintainer account, or exploit the short window before a bad release is noticed. Defenders use Dependabot to keep software patched, but they often add controls such as review rules, lock files, provenance checks, and delays for ordinary version bumps. Those measures slow risky updates without blocking urgent security fixes, making automated dependency management safer and more predictable.