Dependency management

Dependency management is the process of identifying, updating, and governing the third-party packages your project depends on.

In GitHub repositories, this usually means:

  • Detecting outdated dependencies.
  • Detecting known vulnerabilities in dependencies.
  • Raising pull requests to update vulnerable or stale packages.
  • Keeping dependency versions consistent over time.

Why dependency management is important

Most projects rely on open-source libraries. If these dependencies are not managed, teams can quickly accumulate security and maintenance risk.

Good dependency management helps you:

  • Reduce exposure to known vulnerabilities.
  • Keep software supportable and easier to upgrade.
  • Reduce manual effort by automating routine updates.
  • Improve auditability by tracking updates through pull requests.

GitHub Dependabot

GitHub Dependabot is GitHub’s native dependency management tooling. It can automatically:

  • Detect vulnerable dependencies through dependency alerts.
  • Open pull requests for version updates.
  • Open pull requests for security updates.

For most repositories at Imperial, Dependabot should be the default choice because it is built into GitHub and straightforward to adopt.

When to use Dependabot

Use Dependabot when you want:

  • A simple default with minimal setup.
  • Native integration with GitHub pull requests and alerts.
  • Automated security and version updates for common ecosystems.

Renovate

Renovate is an alternative dependency management tool. It supports advanced configuration and can be a good option when Dependabot does not meet your requirements.

Imperial self-hosts Renovate on GitHub Actions, so repository data is not sent to mend.io.

When to use Renovate

Use Renovate when you need capabilities beyond your Dependabot setup, for example:

  • More advanced update grouping and scheduling behaviour.
  • Fine-grained control of update rules across many repositories.
  • Custom onboarding and policy-driven automation.
  • A greater choice of package managers. View Renovate’s full list at Managers.

Getting started

For setup guidance and official onboarding links, see Getting started with dependency management.