❕ Upcoming Change: Dependabot Compute Migration to GitHub Actions

[ghostinhershell]

We’re excited to share an important update about Dependabot: over the coming year, GitHub will be consolidating Dependabot’s compute platform to GitHub Actions. This means that jobs generating pull requests will be run as GitHub Actions workflows. This change allows Dependabot to benefit from the flexibility and power of the GitHub Actions infrastructure—including support for self-hosted runners and advanced networking options.

Key points to note:

• No disruption: Developers will not see any change to their workflow—Dependabot will continue to run seamlessly in the background.
• Still free: Dependabot remains free to use with GitHub Actions. Premium features like larger runners may incur additional charges.
• Visibility: If GitHub Actions is disabled for your repo/org, developers can’t use Actions for other workflows, but Dependabot workflows will still run. You can always view Dependabot job logs from the Insights > Dependency Graph > Dependabot tab.
• Advanced setup: If you use features like vNet (Azure Virtual Network) or ARC (Actions Runner Controller), Dependabot can leverage these as well. For static IP requirements, consider a self-hosted runner or a larger runner with a static IP.

The legacy compute platform for Dependabot will be retired on June 23, 2025.

---

Have questions or feedback?
This Community post is the place to ask! If you have concerns about the migration, setup questions, or suggestions, please leave a comment below.

To learn more about the migration, all the details are covered in our GitHub Blog post.

Thank you for helping us keep the software ecosystem secure!

[Ubaid242]

Thank you for the update! I understand that Dependabot jobs will now run on GitHub Actions instead of the legacy compute platform. It’s great to know there will be no disruption for developers and that Dependabot will continue to run automatically in the background without any extra setup.

It’s also helpful that Dependabot workflows will still work even if GitHub Actions is disabled for other workflows in our repository or organization. I appreciate the flexibility of being able to use self-hosted runners, vNet, or ARC if we have specific networking or static IP requirements.

I’ll make sure to check the Insights > Dependency Graph > Dependabot tab for logs if needed. Thanks for keeping us informed and helping us keep our dependencies secure!