Dependabot is GitHub's service for automated dependency updates, built into GitHub. A dependency is an outside package or library that a project's code uses; its version is written in a manifest or lock file of the repository.
For version updates, a repository holds a dependabot.yml configuration file that names the manifests to watch and the schedule. Dependabot checks each dependency for newer releases, reads its semantic version (semver) to decide whether to update, and opens a pull request that changes the manifest, with the changelog and release notes in the summary. By default a new release waits a cooldown of 3 days. For security updates, when a Dependabot alert reports a known vulnerability, Dependabot opens a pull request that raises the dependency to the lowest version with the fix. It also updates references to GitHub Actions in workflow files, and it signs its own commits.
Dependabot is included in GitHub's Free plan. Its core update logic, dependabot-core, is open source under the MIT license.