How dependabot/dependabot-core works
Dependabot-Core is a library for dependency version and security updates across many package ecosystems. Its principal workflow takes a repository’s dependency files, identifies dependencies, checks for a newer version that remains resolvable, and produces updated manifests and lockfiles; hosting tools can turn those diffs into pull requests. The graph groups shared runtime services, ecosystem-specific adapters, update orchestration, and change/PR support. Some subsystem relationships are documented in the README; source excerpts are limited, so unsampled integrations are not connected speculatively.
Main entry points: ecosystem.rb Ecosystem adapters · dependency.rb Dependency model · package_latest_version_finder.rb Check resolvable versions · base.rb Update manifests and locks
Components 23
Shared runtime
- Fetch dependency files
common/lib/dependabot/file_fetchers/base.rb - Parse dependencies
common/lib/dependabot/file_parsers/base.rb - Dependency model
common/lib/dependabot/dependency.rb
Ecosystem adapters
- Ecosystem adapters
common/lib/dependabot/ecosystem.rb - Bundler adapter
bundler/lib/dependabot/bundler/package_manager.rb - Bun adapter
bun/lib/dependabot/bun/package_manager.rb - Cargo adapter
cargo/lib/dependabot/cargo/package_manager.rb - Npm and Yarn adapter
npm_and_yarn/lib/dependabot/npm_and_yarn/package_manager.rb - Other ecosystem adapters
go_modules/lib/dependabot/go_modules/package_manager.rb - NuGet project files
nuget/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Files/ProjectBuildFile.cs
Update orchestration
- Check resolvable versions
common/lib/dependabot/package/package_latest_version_finder.rb - Group dependencies
updater/lib/dependabot/dependency_group_engine.rb - Update configuration
common/lib/dependabot/config/update_config.rb
Update results
- Update manifests and locks
common/lib/dependabot/file_updaters/base.rb - Artifact updates
common/lib/dependabot/file_updaters/artifact_updater.rb - Release metadata
common/lib/dependabot/metadata_finders/base.rb - Create pull requests
common/lib/dependabot/pull_request_creator.rb - NuGet package updates
nuget/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/PackagesConfigUpdater.cs - Assembly redirects
nuget/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/BindingRedirectManager.cs - Binding redirect model
nuget/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/AssemblyBinding.cs - Redirect resolver
nuget/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/BindingRedirectResolver.cs
Other components
- Project repository
- Hosting platforms
Connections 21
- Project repository → Fetch dependency files: provides files
README.md - Fetch dependency files → Parse dependencies: supplies files
- Parse dependencies → Dependency model: identifies dependencies
- Dependency model → Check resolvable versions: checks versions
README.md - Ecosystem adapters → Bundler adapter: supports ecosystem
README.md - Ecosystem adapters → Bun adapter: supports ecosystem
README.md - Ecosystem adapters → Cargo adapter: supports ecosystem
README.md - Ecosystem adapters → Npm and Yarn adapter: supports ecosystem
README.md - Ecosystem adapters → Other ecosystem adapters: supports ecosystems
README.md - Check resolvable versions → Update manifests and locks: selects update
README.md - Update manifests and locks → Project repository: generates file diffs
README.md - Update manifests and locks → Artifact updates: may update artifacts
- Check resolvable versions → Release metadata: collects release context
README.md - Release metadata → Create pull requests: informs descriptions
README.md - Hosting platforms → Create pull requests: opens pull requests
README.md - Update configuration → Group dependencies: configures groups
- Dependency model → Group dependencies: assigns dependencies
- NuGet project files → NuGet package updates: provides project data
nuget/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/PackagesConfigUpdater.cs - NuGet package updates → Assembly redirects: updates redirects
nuget/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/PackagesConfigUpdater.cs - Assembly redirects → Binding redirect model: writes bindings
nuget/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/BindingRedirectManager.cs - Assembly redirects → Redirect resolver: resolves redirects
nuget/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/BindingRedirectManager.cs