About this project

Dependabot-Core is the library at the heart of Dependabot, GitHub's dependency update tool. It provides the logic to automatically check for the latest resolvable versions of dependencies, generate updated manifests and lockfiles, and create pull requests with changelogs, release notes, and commits. It supports Ruby, JavaScript, Python, PHP, Dart, Elixir, Elm, Go, Rust, Java, Julia, .NET, plus git submodules, Docker, OpenTofu, Terraform, and Pre-Commit hooks. It can open PRs against GitHub, GitHub Enterprise, Azure DevOps, GitLab, BitBucket, and AWS CodeCommit. The repository includes a development guide with a Docker-based developer shell, dry-run script, CLI tool, debugging tips, and testing instructions. It also explains the architecture as a collection of Ruby gems, with `dependabot-common` containing shared functionality. The project is open source and welcomes contributions, with guidelines for reporting issues, submitting pull requests, and adding new ecosystems.