{"meta":{"title":"Dependabot supported ecosystems and repositories","intro":"Dependabot supports a variety of ecosystems and repositories","product":"Security and code quality","breadcrumbs":[{"href":"/en/code-security","title":"Security and code quality"},{"href":"/en/code-security/reference","title":"Reference"},{"href":"/en/code-security/reference/supply-chain-security","title":"Supply chain security"},{"href":"/en/code-security/reference/supply-chain-security/supported-ecosystems-and-repositories","title":"Dependabot ecosystems"}],"documentType":"article"},"body":"# Dependabot supported ecosystems and repositories\n\nDependabot supports a variety of ecosystems and repositories\n\nThis article provides reference information about the package ecosystems and repository types that Dependabot supports.\n\nDependabot is a GitHub tool that helps keep your dependencies secure and up to date. It automatically detects vulnerable or outdated dependencies in your repositories and creates pull requests to update them, making it easier to maintain your software supply chain security. For more information, see [Dependabot quickstart guide](/en/code-security/tutorials/secure-your-dependencies/dependabot-quickstart-guide).\n\n## Supported ecosystems maintained by GitHub\n\n\n\nYou can configure updates for repositories that contain a dependency manifest or lock file for one of the supported package managers. For some package managers, you can also configure vendoring for dependencies. For more information, see [`vendor`](/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference#vendor--).\nDependabot also supports dependencies in private registries. For more information, see [Configuring access to private registries for Dependabot](/en/code-security/dependabot/working-with-dependabot/configuring-access-to-private-registries-for-dependabot).\n\n> \\[!NOTE]\n>\n> * When running security or version updates, some ecosystems must be able to resolve all dependencies from their source to verify that updates have been successful. If your manifest or lock files contain any private dependencies, Dependabot must be able to access the location at which those dependencies are hosted. Organization owners can grant Dependabot access to private repositories containing dependencies for a project within the same organization. For more information, see [Managing security and analysis settings for your organization](/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-dependabot-to-access-private-dependencies). You can configure access to private registries in a repository's `dependabot.yml` configuration file. For more information, see [Configuring access to private registries for Dependabot](/en/code-security/dependabot/working-with-dependabot/configuring-access-to-private-registries-for-dependabot).\n> * Dependabot doesn't support private GitHub dependencies for all package managers. See the details in the table below.\n\nIf your repository already uses an integration for dependency management, you will need to disable this before enabling Dependabot. For more information, see [About GitHub integrations](/en/get-started/exploring-integrations/about-integrations).\n\n\n\n| Package manager | YAML value | Supported versions | Version updates | Security updates | Private repositories | Private registries | Vendoring |\n| ----------------------------------- | ---------------- | -------------------- | :----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------: | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------: | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------: | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------: | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------: |\n| | | | | | | | |\n| Bazel | `bazel` | v7, v8, v9 | | | | | |\n| | | | | | | | |\n| | | | | | | | |\n| [Bun](#bun) | `bun` | >=v1.1.39 | | | | | |\n| | | | | | | | |\n| Bundler | `bundler` | v2 | | | | | |\n| [Cargo](#cargo) | `cargo` | v1 | | | | | |\n| Composer | `composer` | v2 | | | | | |\n| | | | | | | | |\n| [Conda](#conda) | `conda` | Not applicable | | | | | |\n| | | | | | | | |\n| [Dev containers](#dev-containers) | `devcontainers` | Not applicable | | | | | |\n| [Docker](#docker) | `docker` | v1 | | | | | Not applicable |\n| | | | | | | | |\n| [Docker Compose](#docker-compose) | `docker-compose` | v2, v3 | | | | | Not applicable |\n| | | | | | | | |\n| | | | | | | | |\n| .NET SDK | `dotnet-sdk` | >=.NET Core 3.1 | | | Not applicable | Not applicable | Not applicable |\n| | | | | | | | |\n| [Helm Charts](#helm-charts) | `helm` | v3 | | | | | Not applicable |\n| Hex | `mix` | v1 | | | | | |\n| | | | | | | | |\n| [Julia](#julia) | `julia` | >=v1.10 | | | | | |\n| | | | | | | | |\n| elm-package | `elm` | v0.19 | | | | | |\n| git submodule | `gitsubmodule` | Not applicable | | | | | Not applicable |\n| [GitHub Actions](#github-actions) | `github-actions` | Not applicable | | | | | Not applicable |\n| Go modules | `gomod` | v1 | | | | | |\n| [Gradle](#gradle) | `gradle` | Not applicable | | | | | |\n| [Maven](#maven) | `maven` | Not applicable | | | | | |\n| | | | | | | | |\n| [Nix](#nix) | `nix` | Not applicable | | | | Not applicable | Not applicable |\n| | | | | | | | |\n| npm | `npm` | v7, v8, v9, v10, v11 | | | | | |\n| [NuGet](#nuget-cli) | `nuget` | <=6.12.0 | | | | | |\n| | | | | | | | |\n| [OpenTofu](#opentofu) | `opentofu` | Not applicable | | | | | Not applicable |\n| | | | | | | | |\n| [pip](#pip-and-pip-compile) | `pip` | 24.2 | | | | | |\n| pipenv | `pip` | 2024.4.1 | | | | | |\n| [pip-compile](#pip-and-pip-compile) | `pip` | 7.5.3 | | | | | |\n| pnpm | `npm` | v7, v8, v9, v10 | | | | | |\n| [poetry](#poetry) | `pip` | v2 | | | | | |\n| | | | | | | | |\n| [pre-commit](#pre-commit) | `pre-commit` | Not applicable | | | | | |\n| | | | | | | | |\n| [pub](#pub) | `pub` | v2 | | | | | |\n| | | | | | | | |\n| [Rust toolchain](#rust-toolchain) | `rust-toolchain` | Not applicable | | | | Not applicable | Not applicable |\n| | | | | | | | |\n| [Swift](#swift) | `swift` | v5 | | | | (git only) | |\n| [Terraform](#terraform) | `terraform` | >= 0.13, <= 1.13.x | | | | | Not applicable |\n| | | | | | | | |\n| uv | `uv` | v0 | | | | | Not applicable |\n| | | | | | | | |\n| | | | | | | | |\n| [vcpkg](#vcpkg) | `vcpkg` | Not applicable | | | | | Not applicable |\n| | | | | | | | |\n| [yarn](#yarn) | `npm` | v1, v2, v3, v4 | | | | | |\n\n> \\[!TIP]\n> For package managers such as `pipenv` and `poetry`, you need to use the `pip` YAML value. For example, if you use `poetry` to manage your Python dependencies and want Dependabot to monitor your dependency manifest file for new versions, use `package-ecosystem: \"pip\"` in your `dependabot.yml` file.\n\nFor further information about ecosystem support for Dependabot security updates, see also [Dependency graph supported package ecosystems](/en/code-security/supply-chain-security/understanding-your-software-supply-chain/dependency-graph-supported-package-ecosystems).\n\n### Bun\n\nDependabot supports the current default text-based `bun.lock` file, but not the legacy binary `bun.lockb` file. The `bun.lock` file is supported in version 1.1.39 and above. For more information, see [Lockfile](https://bun.sh/docs/install/lockfile) in the Bun documentation.\n\n### Cargo\n\nPrivate registry support includes cargo registries, so you can use Dependabot to keep your Rust dependencies up-to-date. For more information, see [Guidance for the configuration of private registries for Dependabot](/en/code-security/dependabot/working-with-dependabot/guidance-for-the-configuration-of-private-registries-for-dependabot#cargo).\n\n### Conda\n\nDependabot support for Conda does **not include private registries, vendoring, or lock file updates**.\n\n### Dev containers\n\nYou can use `devcontainers` as a `package-ecosystem` in your `dependabot.yml` file to update Features in your `devcontainer.json` configuration files. For more information about this support, and for configuration file examples, see [General Availability of Dependabot Integration](https://containers.dev/guide/dependabot) in the Development Containers documentation.\n\nDev containers are used in several tools and services, including Codespaces. For more information about Features and the supported services, see [Features](https://containers.dev/implementors/features/) and [Supporting tools and services](https://containers.dev/supporting) in the Development Containers documentation, respectively.\n\nThis updater ensures Features are pinned to the latest `major` version in the associated `devcontainer.json` file. If a dev container has a lockfile, that file will also be updated. For more information about lockfile specifications, see [Lockfiles](https://github.com/devcontainers/spec/blob/main/docs/specs/devcontainer-lockfile.md) in the `devcontainers/spec` repository.\n\nFeatures in any valid dev container location will be updated in a single pull request. For more information about the dev container specification, see [Specification](https://containers.dev/implementors/spec/#devcontainerjson) in the Development Containers documentation.\n\n### Docker\n\nDependabot can add metadata from Docker images to pull requests for version updates. The metadata includes release notes, changelogs and the commit history. Repository administrators can use the metadata to quickly evaluate the stability risk of the dependency update.\n\nIn order for Dependabot to fetch Docker metadata, maintainers of Docker images must add the `org.opencontainers.image.source` label to their Dockerfile, and include the URL of the source repository. Additionally, maintainers must tag the repository with the same tags as the published Docker images. For an example, see the [`dependabot-fixtures/docker-with-source`](https://github.com/dependabot-fixtures/docker-with-source) repository. For more information on Docker labels, see [Extension image labels](https://docs.docker.com/desktop/extensions-sdk/extensions/labels/) and [BUILDX\\_GIT\\_LABELS](https://docs.docker.com/build/building/env-vars/#buildx_git_labels) in the Docker documentation.\n\nDependabot can update Docker image tags in Kubernetes manifests. Add an entry to the Docker `package-ecosystem` element of your `dependabot.yml` file for each directory containing a Kubernetes manifest which references Docker image tags. Kubernetes manifests can be Kubernetes Deployment YAML files or Helm charts. For information about configuring your `dependabot.yml` file for `docker`, see \"`package-ecosystem`\" in [Dependabot options reference](/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference#package-ecosystem-).\n\nDependabot supports both public and private Docker registries. For a list of the supported registries, see \"`docker-registry`\" in [Configuring access to private registries for Dependabot](/en/code-security/dependabot/working-with-dependabot/configuring-access-to-private-registries-for-dependabot#docker-registry).\n\nDependabot parses Docker image tags for Semantic Versioning ([SemVer](https://semver.org/)). If Dependabot detects a tag with a pre-release, then it will only suggest an update to the latest version with a matching pre-release, and it will not suggest a newer version that use a different pre-release label. For more information, see the `dependabot-docker` [README.md](https://github.com/dependabot/dependabot-core/blob/main/docker/README.md) file in the `dependabot/dependabot-core` repository.\n\n### Docker Compose\n\nDependabot supports Docker Compose in a similar way to Docker. For more information, see [Docker](#docker).\n\n### GitHub Actions\n\nDependabot supports version updates for GitHub Actions with the following caveats.\n\n* Dependabot only supports updates to GitHub Actions using the GitHub repository syntax, such as `actions/checkout@v6` or `actions/checkout@` . Dependabot will ignore actions or reusable workflows referenced locally (for example, `./.github/actions/foo.yml`).\n* Dependabot updates the version documentation of GitHub Actions when the comment is on the same line, such as `actions/checkout@ #` or `actions/checkout@ #`.\n* If the commit you use is not associated with any tag, Dependabot will update the GitHub Actions to the latest commit (which might differ from the latest release).\n* Docker Hub and GitHub Packages Container registry URLs are currently not supported. For example, references to Docker container actions using `docker://` syntax aren't supported.\n* Dependabot supports both public and private repositories for GitHub Actions. For private registry configuration options, see \"`git`\" in [Dependabot options reference](/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#git).\n\nFor more information about using Dependabot version updates with GitHub Actions, see [Secure use reference](/en/actions/security-guides/using-githubs-security-features-to-secure-your-use-of-github-actions#keeping-the-actions-in-your-workflows-secure-and-up-to-date).\n\n### Gradle\n\nDependabot supports updates to the following files without needing to run Gradle:\n\n* `build.gradle`, `build.gradle.kts` (for Kotlin projects)\n* `gradle/libs.versions.toml` (for projects using a standard Gradle version catalog)\n* `gradle.lockfile` (for projects using Gradle dependency locking)\n* Files included via the `apply` declaration that have `dependencies` in the filename. Note that `apply` does not support `apply to`, recursion, or advanced syntaxes (for example, Kotlin's `apply` with `mapOf`, filenames defined by property).\n\nTo update the Gradle Wrapper, Dependabot runs Gradle and updates:\n\n* `gradle/wrapper/gradle-wrapper.properties`\n* `gradlew`\n* `gradlew.bat`\n* `gradle/wrapper/gradle-wrapper.jar`\n\nDependabot uses information from the `pom.xml` file of dependencies to add links to release information in update pull requests. If the information is omitted from the `pom.xml` file, then it cannot be included in Dependabot pull requests, see [Java package metadata for Dependabot updates](/en/code-security/dependabot/ecosystems-supported-by-dependabot/optimizing-java-packages-dependabot).\n\nFor Dependabot security updates, Gradle support is limited to manual uploads of the dependency graph data using the dependency submission API. For more information about the dependency submission API, see [Using the dependency submission API](/en/code-security/supply-chain-security/understanding-your-software-supply-chain/using-the-dependency-submission-api).\n\n> \\[!NOTE]\n>\n> * When you upload Gradle dependencies to the dependency graph using the dependency submission API, all project dependencies are uploaded, even transitive dependencies that aren't explicitly mentioned in any dependency file. When an alert is detected in a transitive dependency, Dependabot isn't able to find the vulnerable dependency in the repository, and therefore won't create a security update for that alert.\n> * Dependabot version updates will, however, create pull requests when the parent dependency is explicitly declared as a direct dependency in the project's manifest file.\n\n### Helm Charts\n\nDependabot supports using a username and password for registries. For more information, see [Configuring access to private registries for Dependabot](/en/code-security/dependabot/working-with-dependabot/configuring-access-to-private-registries-for-dependabot#helm-registry).\n\nThe `helm-registry` type only supports HTTP Basic Auth and does not support OCI-compliant registries. If you need to access an OCI-compliant registry for Helm charts, configure a `docker-registry` instead. For more information, see [Configuring access to private registries for Dependabot](/en/code-security/dependabot/working-with-dependabot/configuring-access-to-private-registries-for-dependabot#docker-registry).\n\nWhen configuring Dependabot for Helm charts, it will also automatically update the Docker images referenced within those charts, ensuring that both the chart versions and their contained images stay up to date.\n\n### Maven\n\nDependabot doesn't run Maven but supports updates to `pom.xml` files.\n\nDependabot uses information from the `pom.xml` file of dependencies to add links to release information in update pull requests. If the information is omitted from the `pom.xml` file, then it cannot be included in Dependabot pull requests, see [Java package metadata for Dependabot updates](/en/code-security/dependabot/ecosystems-supported-by-dependabot/optimizing-java-packages-dependabot).\n\n### Nix\n\nDependabot monitors your `flake.lock` file and opens pull requests when newer commits are available upstream for your flake inputs. GitHub, GitLab, SourceHut, and plain Git inputs are all supported. Updating pinned refs inside `flake.nix` itself (for example, changing `github:cachix/devenv/v0.5` to a newer tag) is not supported.\n\nDependabot does not currently support private repositories for the `nix` ecosystem.\n\n### NuGet CLI\n\nDependabot doesn't run the NuGet CLI but does support most features up until version 6.8.0.\n\n### pip and pip-compile\n\nDependabot supports updates to any `.txt` file.\n\nIn addition, Dependabot supports updates to `pyproject.toml` files if they follow the PEP 621 standard.\n\n### poetry\n\nDependabot supports Poetry v2.\n\n### pre-commit\n\nDependabot can update hook revisions in `.pre-commit-config.yaml` files. When a hook pins a specific commit SHA, Dependabot resolves the latest matching tag and updates the `rev` value accordingly.\n\nYou can use a `# frozen:` comment after the `rev` value to pin a hook to a particular version or version prefix. Dependabot uses this comment to determine whether an update is needed and which tag to resolve.\n\n| Scenario | Behavior |\n| --------------------------------------------------------------------- | ---------------------------------------------------------------------------------------- |\n| `rev: # frozen: 7.3.0` and 7.3.0 is the latest version | No update. The dependency is already current. |\n| `rev: # frozen: 7.3.0` and 8.0.0 has been released | Updated to the SHA for the `8.0.0` tag. The comment is updated to `# frozen: 8.0.0`. |\n| `rev: # frozen: v1` and `v1.43.5` is the latest `v1.x` release | Updated to the SHA for the `v1.43.5` tag. The comment is updated to `# frozen: v1.43.5`. |\n| `rev: ` with no `# frozen:` comment | Updated to the HEAD SHA of the default branch. |\n\nIn addition to updating hook revisions, Dependabot can update `additional_dependencies` for hooks that use the following languages: Python, Node, Go, Rust, Ruby and Dart.\n\nPrivate registry support uses git registries. You can configure access for private git repositories by specifying a git registry in your `dependabot.yml` file. For more information, see [Configuring access to private registries for Dependabot](/en/code-security/dependabot/working-with-dependabot/configuring-access-to-private-registries-for-dependabot#git).\n\n> \\[!NOTE]\n> Private registries are not supported for `additional_dependencies`.\n\n### Rust toolchain\n\nDependabot supports automatic updates for Rust toolchain versions defined in `rust-toolchain.toml` and `rust-toolchain` files.\n\nSupported update patterns Dependabot can update:\n\n* Versioned toolchains such as `channel = \"1.xx.yy\"` and `channel = \"1.xx\"`.\n* Dated toolchains such as `channel = \"nightly-YYYY-MM-DD\"` and `channel = \"beta-YYYY-MM-DD\"`.\n\n### Swift\n\nPrivate registry support applies to git registries only. Swift registries are not supported. Non-declarative manifests are not supported. For more information on non-declarative manifests, see [Editing Non-Declarative Manifests](https://github.com/apple/swift-evolution/blob/7003da1439ad60896ec14657dfce829f04b0632c/proposals/0301-package-editing-commands.md#editing-non-declarative-manifests) in the Swift Evolution documentation.\n\n### Terraform\n\nTerraform support includes:\n\n* Modules hosted on Terraform Registry or a publicly reachable Git repository.\n* Terraform providers.\n* Private Terraform Registry. You can configure access for private git repositories by specifying a git registry in your `dependabot.yml` file. For more information, see [`git`](/en/code-security/dependabot/working-with-dependabot/configuring-access-to-private-registries-for-dependabot#git).\n\n### vcpkg\n\nvcpkg support includes updating the `builtin-baseline` commit SHA from the vcpkg ports repository in your `vcpkg.json` manifest file. For more information visit the [`microsoft/vcpkg` repository](https://github.com/microsoft/vcpkg) on GitHub.com and see [What is manifest mode?](https://learn.microsoft.com/vcpkg/concepts/manifest-mode) in the Microsoft documentation.\n\n### yarn\n\nDependabot supports vendored dependencies for v2 onwards.\n\n## Supported community-maintained ecosystems\n\nThe following ecosystems are maintained by their upstream community maintainers. GitHub integrates Dependabot with these ecosystems but does not maintain them directly.\n\n* [Julia](#julia) - Maintained by the Julia community\n* [OpenTofu](#opentofu) - Maintained by the OpenTofu community\n* [Pub](#pub) - Maintained by The Dart Community\n\n### Julia\n\nDependabot supports Julia projects that include `Project.toml`/`Manifest.toml` files. Dependabot uses Julia's package manager to resolve and update dependencies.\n\n### OpenTofu\n\nDependabot supports updating OpenTofu modules and providers in `.tf` and `.tofu` configuration files, including `terragrunt.hcl` files. If the `.terraform.lock.hcl` lockfile for provider checksums is present, Dependabot will also update it.\n\n### Pub\n\nDependabot won't perform an update for `pub` when the version that it tries to update to is ignored, even if an earlier version is available.\n\nYou can use Dependabot to keep Dart dependencies up-to-date if you use private hosted pub repositories. For information about allowing Dependabot to access private GitHub dependencies, see [Allowing Dependabot to access private dependencies](/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-dependabot-to-access-private-dependencies)."}