# dependabot/dependabot-core architecture

> Architecture diagram of the GitHub repository dependabot/dependabot-core, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-10-27). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/dependabot/dependabot-core
- Repository: https://github.com/dependabot/dependabot-core
- Video tour (about a minute): https://gitdiagram.com/dependabot/dependabot-core/video

## Overview

Dependabot-Core is a library for dependency version and security updates across many package ecosystems. Its principal workflow takes a repository’s dependency files, identifies dependencies, checks for a newer version that remains resolvable, and produces updated manifests and lockfiles; hosting tools can turn those diffs into pull requests. The graph groups shared runtime services, ecosystem-specific adapters, update orchestration, and change/PR support. Some subsystem relationships are documented in the README; source excerpts are limited, so unsampled integrations are not connected speculatively.

Main entry points: [`common/lib/dependabot/ecosystem.rb`](https://github.com/dependabot/dependabot-core/blob/main/common/lib/dependabot/ecosystem.rb) (Ecosystem adapters), [`common/lib/dependabot/dependency.rb`](https://github.com/dependabot/dependabot-core/blob/main/common/lib/dependabot/dependency.rb) (Dependency model), [`common/lib/dependabot/package/package_latest_version_finder.rb`](https://github.com/dependabot/dependabot-core/blob/main/common/lib/dependabot/package/package_latest_version_finder.rb) (Check resolvable versions), [`common/lib/dependabot/file_updaters/base.rb`](https://github.com/dependabot/dependabot-core/blob/main/common/lib/dependabot/file_updaters/base.rb) (Update manifests and locks)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_shared["Shared runtime"]
  node_fetch["Fetch dependency files<br/>[base.rb]"]
  node_parse["Parse dependencies<br/>[base.rb]"]
  node_dependency["Dependency model<br/>[dependency.rb]"]
end

subgraph group_ecosystems["Ecosystem adapters"]
  node_ecosystems["Ecosystem adapters<br/>[ecosystem.rb]"]
  node_bundler["Bundler adapter<br/>[package_manager.rb]"]
  node_bun["Bun adapter<br/>[package_manager.rb]"]
  node_cargo["Cargo adapter<br/>[package_manager.rb]"]
  node_npm["Npm and Yarn adapter<br/>[package_manager.rb]"]
  node_other_adapters["Other ecosystem adapters<br/>[package_manager.rb]"]
  node_nuget_project["NuGet project files"]
end

subgraph group_orchestration["Update orchestration"]
  node_check["Check resolvable versions"]
  node_groups["Group dependencies"]
  node_config["Update configuration<br/>[update_config.rb]"]
end

subgraph group_results["Update results"]
  node_update_files["Update manifests and locks<br/>[base.rb]"]
  node_artifact["Artifact updates"]
  node_metadata["Release metadata<br/>[base.rb]"]
  node_pull_request["Create pull requests"]
  node_nuget_packages["NuGet package updates"]
  node_nuget_redirects["Assembly redirects"]
  node_nuget_binding["Binding redirect model<br/>[AssemblyBinding.cs]"]
  node_nuget_resolver["Redirect resolver"]
end

node_repo(("Project repository"))
node_hosting(("Hosting platforms"))

node_repo -->|"provides files"| node_fetch
node_fetch -.->|"supplies files"| node_parse
node_parse -.->|"identifies dependencies"| node_dependency
node_dependency -->|"checks versions"| node_check
node_ecosystems -->|"supports ecosystem"| node_bundler
node_ecosystems -->|"supports ecosystem"| node_bun
node_ecosystems -->|"supports ecosystem"| node_cargo
node_ecosystems -->|"supports ecosystem"| node_npm
node_ecosystems -->|"supports ecosystems"| node_other_adapters
node_check -->|"selects update"| node_update_files
node_update_files -->|"generates file diffs"| node_repo
node_update_files -.->|"may update artifacts"| node_artifact
node_check -->|"collects release context"| node_metadata
node_metadata -->|"informs descriptions"| node_pull_request
node_hosting -->|"opens pull requests"| node_pull_request
node_config -.->|"configures groups"| node_groups
node_dependency -.->|"assigns dependencies"| node_groups
node_nuget_project -.->|"provides project data"| node_nuget_packages
node_nuget_packages -->|"updates redirects"| node_nuget_redirects
node_nuget_redirects -->|"writes bindings"| node_nuget_binding
node_nuget_redirects -->|"resolves redirects"| node_nuget_resolver

click node_fetch "https://github.com/dependabot/dependabot-core/blob/main/common/lib/dependabot/file_fetchers/base.rb"
click node_parse "https://github.com/dependabot/dependabot-core/blob/main/common/lib/dependabot/file_parsers/base.rb"
click node_dependency "https://github.com/dependabot/dependabot-core/blob/main/common/lib/dependabot/dependency.rb"
click node_ecosystems "https://github.com/dependabot/dependabot-core/blob/main/common/lib/dependabot/ecosystem.rb"
click node_bundler "https://github.com/dependabot/dependabot-core/blob/main/bundler/lib/dependabot/bundler/package_manager.rb"
click node_bun "https://github.com/dependabot/dependabot-core/blob/main/bun/lib/dependabot/bun/package_manager.rb"
click node_cargo "https://github.com/dependabot/dependabot-core/blob/main/cargo/lib/dependabot/cargo/package_manager.rb"
click node_npm "https://github.com/dependabot/dependabot-core/blob/main/npm_and_yarn/lib/dependabot/npm_and_yarn/package_manager.rb"
click node_other_adapters "https://github.com/dependabot/dependabot-core/blob/main/go_modules/lib/dependabot/go_modules/package_manager.rb"
click node_check "https://github.com/dependabot/dependabot-core/blob/main/common/lib/dependabot/package/package_latest_version_finder.rb"
click node_groups "https://github.com/dependabot/dependabot-core/blob/main/updater/lib/dependabot/dependency_group_engine.rb"
click node_config "https://github.com/dependabot/dependabot-core/blob/main/common/lib/dependabot/config/update_config.rb"
click node_update_files "https://github.com/dependabot/dependabot-core/blob/main/common/lib/dependabot/file_updaters/base.rb"
click node_artifact "https://github.com/dependabot/dependabot-core/blob/main/common/lib/dependabot/file_updaters/artifact_updater.rb"
click node_metadata "https://github.com/dependabot/dependabot-core/blob/main/common/lib/dependabot/metadata_finders/base.rb"
click node_pull_request "https://github.com/dependabot/dependabot-core/blob/main/common/lib/dependabot/pull_request_creator.rb"
click node_nuget_project "https://github.com/dependabot/dependabot-core/blob/main/nuget/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Files/ProjectBuildFile.cs"
click node_nuget_packages "https://github.com/dependabot/dependabot-core/blob/main/nuget/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/PackagesConfigUpdater.cs"
click node_nuget_redirects "https://github.com/dependabot/dependabot-core/blob/main/nuget/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/BindingRedirectManager.cs"
click node_nuget_binding "https://github.com/dependabot/dependabot-core/blob/main/nuget/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/AssemblyBinding.cs"
click node_nuget_resolver "https://github.com/dependabot/dependabot-core/blob/main/nuget/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/BindingRedirectResolver.cs"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_fetch,node_parse,node_dependency toneBlue
class node_ecosystems,node_bundler,node_bun,node_cargo,node_npm,node_other_adapters,node_nuget_project toneAmber
class node_check,node_groups,node_config toneMint
class node_update_files,node_artifact,node_metadata,node_pull_request,node_nuget_packages,node_nuget_redirects,node_nuget_binding,node_nuget_resolver toneRose
class node_repo,node_hosting toneIndigo
```

## Components

### Shared runtime

- [Fetch dependency files](https://github.com/dependabot/dependabot-core/blob/main/common/lib/dependabot/file_fetchers/base.rb): `common/lib/dependabot/file_fetchers/base.rb`
- [Parse dependencies](https://github.com/dependabot/dependabot-core/blob/main/common/lib/dependabot/file_parsers/base.rb): `common/lib/dependabot/file_parsers/base.rb`
- [Dependency model](https://github.com/dependabot/dependabot-core/blob/main/common/lib/dependabot/dependency.rb): `common/lib/dependabot/dependency.rb`

### Ecosystem adapters

- [Ecosystem adapters](https://github.com/dependabot/dependabot-core/blob/main/common/lib/dependabot/ecosystem.rb): `common/lib/dependabot/ecosystem.rb`
- [Bundler adapter](https://github.com/dependabot/dependabot-core/blob/main/bundler/lib/dependabot/bundler/package_manager.rb): `bundler/lib/dependabot/bundler/package_manager.rb`
- [Bun adapter](https://github.com/dependabot/dependabot-core/blob/main/bun/lib/dependabot/bun/package_manager.rb): `bun/lib/dependabot/bun/package_manager.rb`
- [Cargo adapter](https://github.com/dependabot/dependabot-core/blob/main/cargo/lib/dependabot/cargo/package_manager.rb): `cargo/lib/dependabot/cargo/package_manager.rb`
- [Npm and Yarn adapter](https://github.com/dependabot/dependabot-core/blob/main/npm_and_yarn/lib/dependabot/npm_and_yarn/package_manager.rb): `npm_and_yarn/lib/dependabot/npm_and_yarn/package_manager.rb`
- [Other ecosystem adapters](https://github.com/dependabot/dependabot-core/blob/main/go_modules/lib/dependabot/go_modules/package_manager.rb): `go_modules/lib/dependabot/go_modules/package_manager.rb`
- [NuGet project files](https://github.com/dependabot/dependabot-core/blob/main/nuget/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Files/ProjectBuildFile.cs): `nuget/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Files/ProjectBuildFile.cs`

### Update orchestration

- [Check resolvable versions](https://github.com/dependabot/dependabot-core/blob/main/common/lib/dependabot/package/package_latest_version_finder.rb): `common/lib/dependabot/package/package_latest_version_finder.rb`
- [Group dependencies](https://github.com/dependabot/dependabot-core/blob/main/updater/lib/dependabot/dependency_group_engine.rb): `updater/lib/dependabot/dependency_group_engine.rb`
- [Update configuration](https://github.com/dependabot/dependabot-core/blob/main/common/lib/dependabot/config/update_config.rb): `common/lib/dependabot/config/update_config.rb`

### Update results

- [Update manifests and locks](https://github.com/dependabot/dependabot-core/blob/main/common/lib/dependabot/file_updaters/base.rb): `common/lib/dependabot/file_updaters/base.rb`
- [Artifact updates](https://github.com/dependabot/dependabot-core/blob/main/common/lib/dependabot/file_updaters/artifact_updater.rb): `common/lib/dependabot/file_updaters/artifact_updater.rb`
- [Release metadata](https://github.com/dependabot/dependabot-core/blob/main/common/lib/dependabot/metadata_finders/base.rb): `common/lib/dependabot/metadata_finders/base.rb`
- [Create pull requests](https://github.com/dependabot/dependabot-core/blob/main/common/lib/dependabot/pull_request_creator.rb): `common/lib/dependabot/pull_request_creator.rb`
- [NuGet package updates](https://github.com/dependabot/dependabot-core/blob/main/nuget/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/PackagesConfigUpdater.cs): `nuget/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/PackagesConfigUpdater.cs`
- [Assembly redirects](https://github.com/dependabot/dependabot-core/blob/main/nuget/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/BindingRedirectManager.cs): `nuget/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/BindingRedirectManager.cs`
- [Binding redirect model](https://github.com/dependabot/dependabot-core/blob/main/nuget/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/AssemblyBinding.cs): `nuget/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/AssemblyBinding.cs`
- [Redirect resolver](https://github.com/dependabot/dependabot-core/blob/main/nuget/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/BindingRedirectResolver.cs): `nuget/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/BindingRedirectResolver.cs`

### Other components

- **Project repository**
- **Hosting platforms**

## Connections

- Project repository → Fetch dependency files: provides files (evidence: `README.md`)
- Fetch dependency files → Parse dependencies: supplies files
- Parse dependencies → Dependency model: identifies dependencies
- Dependency model → Check resolvable versions: checks versions (evidence: `README.md`)
- Ecosystem adapters → Bundler adapter: supports ecosystem (evidence: `README.md`)
- Ecosystem adapters → Bun adapter: supports ecosystem (evidence: `README.md`)
- Ecosystem adapters → Cargo adapter: supports ecosystem (evidence: `README.md`)
- Ecosystem adapters → Npm and Yarn adapter: supports ecosystem (evidence: `README.md`)
- Ecosystem adapters → Other ecosystem adapters: supports ecosystems (evidence: `README.md`)
- Check resolvable versions → Update manifests and locks: selects update (evidence: `README.md`)
- Update manifests and locks → Project repository: generates file diffs (evidence: `README.md`)
- Update manifests and locks → Artifact updates: may update artifacts
- Check resolvable versions → Release metadata: collects release context (evidence: `README.md`)
- Release metadata → Create pull requests: informs descriptions (evidence: `README.md`)
- Hosting platforms → Create pull requests: opens pull requests (evidence: `README.md`)
- Update configuration → Group dependencies: configures groups
- Dependency model → Group dependencies: assigns dependencies
- NuGet project files → NuGet package updates: provides project data (evidence: `nuget/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/PackagesConfigUpdater.cs`)
- NuGet package updates → Assembly redirects: updates redirects (evidence: `nuget/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/PackagesConfigUpdater.cs`)
- Assembly redirects → Binding redirect model: writes bindings (evidence: `nuget/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/BindingRedirectManager.cs`)
- Assembly redirects → Redirect resolver: resolves redirects (evidence: `nuget/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/BindingRedirectManager.cs`)