dependabot-core

<h1 align="center">
    <picture>
        <source media="(prefers-color-scheme: light)" srcset="https://user-images.githubusercontent.com/7659/174594540-5e29e523-396a-465b-9a6e-6cab5b15a568.svg">
        <source media="(prefers-color-scheme: dark)" srcset="https://user-images.githubusercontent.com/7659/174594559-0b3ddaa7-e75b-4f10-9dee-b51431a9fd4c.svg">
        <img src="https://user-images.githubusercontent.com/7659/174594540-5e29e523-396a-465b-9a6e-6cab5b15a568.svg" alt="Dependabot" width="336">
    </picture>
</h1>

Welcome to the public home of Dependabot :dependabot:.

# Table of Contents

- [What is Dependabot-Core?](#what-is-dependabot-core)
- [How to run Dependabot](#how-to-run-dependabot)
- [Contributing to Dependabot](#contributing-to-dependabot)
  - [Reporting Issues and Feature Requests](#reporting-issues-and-feature-requests)
  - [Submitting Pull Requests](#submitting-pull-requests)
  - [New Ecosystems](#new-ecosystems)
- [Development Guide](#development-guide)
  - [Getting a Development Environment Running](#getting-a-development-environment-running)
  - [Debugging Problems](#debugging-problems)
  - [Running Tests](#running-tests)
  - [Profiling](#profiling)
- [Architecture and Code Layout](#architecture-and-code-layout)
- [Trademarks](#trademarks)
- [Notes for Project Maintainers](#notes-for-project-maintainers)

---

# What is Dependabot-Core?

Dependabot-Core is the library at the heart of [Dependabot](https://docs.github.com/en/code-security/dependabot) security / version updates.

Use it to generate automated pull requests updating dependencies for projects written in Ruby, JavaScript, Python,
PHP, Dart, Elixir, Elm, Go, Rust, Java, Julia, and .NET. It can also update git submodules, Docker files, Opentofu, Terraform files and Pre-Commit hooks.
Features include:

- Check for the latest version of a dependency *that's resolvable given a project's other dependencies*
- Generate updated manifest and lockfiles for a new dependency version
- Generate PR descriptions that include the updated dependency's changelogs, release notes, and commits

# How to run Dependabot

Most people are familiar with the Dependabot service that runs on GitHub.com and GitHub Enterprise. Enabling that is as
simple as [checking a `dependabot.yml` configuration file in to your repository's `.github` directory](https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuring-dependabot-version-updates).

However, if you want to run a custom version of Dependabot or run it on another platform, you're not left out in the cold.
This repo provides the logic necessary for hosting your own standalone Dependabot. It currently supports opening Pull Requests against repositories hosted on GitHub, Github Enterprise, Azure DevOps, GitLab, BitBucket, and AWS CodeCommit.

Dependabot-Core is a library, so you'll need an entrypoint script of some kind. Here are a few examples to help you get
started.

>**Note:** If you're looking to run Dependabo