# Dependabot 42 Hacker News commenters recommended Dependabot and 47 criticized it, November 2025 to November 2026. It was recommended in 12 of 13 months. **Verdict:** Recommended for opening dependency update pull requests automatically across many languages, with a cooldown delay setting. Critics say it creates noisy PRs and weak vulnerability alerts. ## Why people recommend it - Keeps dependencies updated automatically (5 comments): "Use Dependabot to keep dependencies up to date, but configure a dependency cooldown so you don't end up installing anything too new." ([source](https://news.ycombinator.com/item?id=46079588)) "Letting one computer send you patches and the other computer merge it for you when all your tests pass is a good thing." ([source](https://news.ycombinator.com/item?id=46664740)) "I have found a reliable way to keep things up-to-date is enabling dependabot and merging relentlessly" ([source](https://news.ycombinator.com/item?id=47098897)) - Cooldown setting delays risky new releases (4 comments): "Use Dependabot to keep dependencies up to date, but configure a dependency cooldown so you don't end up installing anything too new." ([source](https://news.ycombinator.com/item?id=46079588)) "having Dependabot update dependencies automatically after a cooldown still seems like a better alternative" ([source](https://news.ycombinator.com/item?id=47094817)) "The cooldown setting in dependabot solves this attack vector." ([source](https://news.ycombinator.com/item?id=48657185)) - Free and integrates with GitHub (3 comments): "Dependabot integrates decently well with Github of course but so far renovate has worked well for us." ([source](https://news.ycombinator.com/item?id=46538096)) "We offer a Github app that integrates with alerts from Dependabot." ([source](https://news.ycombinator.com/item?id=45998406)) "Dependabot will watch for new versions and submit a PR for free." ([source](https://news.ycombinator.com/item?id=49517070)) - Works across languages and platforms (2 comments): "What's nice about Dependabot is that it works across multiple languages and platforms." ([source](https://news.ycombinator.com/item?id=47094742)) "one of the benefits of Dependabot (and Renovate) are that they are language-agnostic" ([source](https://news.ycombinator.com/item?id=47099201)) ## What people warn about - Floods repos with noisy PRs (7 comments): "We started by having it doing PR for every single dependencies update every day, but that was a little too much noise" ([source](https://news.ycombinator.com/item?id=46295477)) "GitHub spammed me with notifications from it." ([source](https://news.ycombinator.com/item?id=46539244)) "The emails are annoying and I mostly filter" ([source](https://news.ycombinator.com/item?id=47095058)) - Vulnerability alerts are often irrelevant (5 comments): "Dependabot’s built-in vulnerability scanning is strictly worse than just about every ecosystem’s own built-in solution." ([source](https://news.ycombinator.com/item?id=47095621)) "So so so many "regular expression denial-of-service" issues at my last job that just didn't seem serious or often reachable." ([source](https://news.ycombinator.com/item?id=48914257)) "The number of ReDoS vulnerabilities we see in Dependabot alerts for NPM packages we’re only using in client code is absurd." ([source](https://news.ycombinator.com/item?id=47094795)) - Scale limits and slow feature support (3 comments): "At sufficient scale, Dependabot’s analysis will time out before completing, effectively rate-limiting the number of PRs it can generate." ([source](https://news.ycombinator.com/item?id=46659903)) "This is a (ridiculous, IMO) platform limitation that GitHub could lift by applying more engineering time to Dependabot" ([source](https://news.ycombinator.com/item?id=47939966)) "It is quite slow to get support for newer conventions that are not ubiquitous across all of github." ([source](https://news.ycombinator.com/item?id=46537177)) - Updates to broken packages bypass cooldown (2 comments): "But updates to broken packages are still allowed: if a new version is pushed within the three days, it does not reset the cool-down." ([source](https://news.ycombinator.com/item?id=48914160)) "Dependabot (and probably others) don't consider cooldown when suggesting security upgrades" ([source](https://news.ycombinator.com/item?id=46008531)) ## Alternatives hackers recommend - [Renovate](https://hackerapproved.com/p/renovate.md): 27 recommend ## Where to get it - [Visit the official site](https://docs.github.com/en/code-security/how-tos/secure-your-supply-chain) ## Cite as Hacker Approved, "Dependabot", https://hackerapproved.com/p/dependabot/ (counts from 1,795,640 Hacker News comments, November 2025 to November 2026).