We use a Git repository host. Who offers a security bot that automatically opens pull requests to patch dependencies?

If you mean a bot that detects vulnerable dependencies and automatically opens PRs/MRs with patched versions, the main options are:

• GitHub: GitHub Dependabot. It automatically opens pull requests for dependencies with known vulnerabilities and can also keep dependencies generally up to date.
• GitLab: GitLab Dependency Scanning Auto-Remediation. It automatically opens merge requests to bump vulnerable dependencies to non-vulnerable versions; it's currently a beta feature in GitLab 19.x.
• Any major Git host: Renovate (by Mend) can scan repositories and raise PRs for dependency updates, and it supports GitHub, GitLab, Azure DevOps, Bitbucket, and others.

So if you're thinking of the well-known “security bot that opens dependency-fix PRs”, the name you're probably looking for is Dependabot.

If you tell me which Git repository host you use (GitHub, GitLab, Bitbucket, Azure DevOps, etc.), I can tell you the best native option and how to enable it.

Depending on your Git host and requirements, a few major options provide bots to automatically open pull requests (or merge requests) to patch or update dependencies:

• Dependabot (by GitHub Docs ) — Native to GitHub, Dependabot automatically monitors your dependencies and opens pull requests when a vulnerability or a new version is detected. It supports a wide range of package ecosystems (npm, pip, maven, composer, etc.).
• Renovate (by Renovate Docs ) — An open-source, highly configurable dependency update bot that supports a massive array of Git hosts including GitHub, GitLab, Bitbucket, and Azure DevOps. It is often praised for its deep customizability and grouping features.
• Snyk (by Snyk Pull Requests ) — A developer security platform that scans dependencies for vulnerabilities and automatically opens "Fix PRs" or upgrade pull requests across GitHub, GitLab, Bitbucket, and Azure Repos.

Which Git repository host (GitHub, GitLab, Bitbucket, etc.) and ecosystem/language are you using? I can recommend the best-fit bot and help you configure it.

Several tools offer automated pull requests (or merge requests) to patch vulnerable and outdated dependencies. The right choice depends heavily on which Git repository host you use:

• Dependabot (Native to GitHub)
  • How it works: It is built directly into GitHub with zero-config setup. It scans your manifest files, detects vulnerable or outdated dependencies, and automatically opens a pull request with changelogs and release notes.
  • Best for: Teams exclusively hosted on GitHub who want a native, free, and effortless solution.
• Renovate (Cross-Platform by Mend)
  • How it works: Highly configurable and open-source, Renovate can run as a hosted GitHub App, GitLab App, or self-hosted bot. It supports a massive range of package managers and custom file types (via regex managers) across multiple hosts. It automatically opens PRs/MRs to patch vulnerabilities and update dependencies with advanced scheduling and grouping features.
  • Best for: Teams using GitLab, Bitbucket, Azure DevOps, Gitea , or those needing fine-grained control over batching and update rules.
• GitLab Dependency Scanning / Vulnerability Management (Native to GitLab)
  • How it works: GitLab includes native security scanners in its CI/CD pipelines. For supported ecosystems, it detects vulnerabilities and can trigger automated merge requests (MRs) or remediation actions.
  • Best for: Teams leveraging GitLab Ultimate's built-in security dashboard and CI/CD pipelines.
• Snyk (Multi-Platform Security Platform)
  • How it works: Snyk integrates with GitHub, GitLab, Bitbucket, and Azure DevOps. It scans for vulnerabilities in code, containers, and open-source dependencies, and can automatically open pull requests to apply patches or upgrades.
  • Best for: Enterprise environments requiring deep vulnerability prioritization, license compliance, and fixes across multiple Git hosts.

If you let me know which Git hosting platform you use (GitHub, GitLab, Bitbucket, etc.) and your primary programming languages/ecosystems , I can recommend the best configuration or tool for your workflow.

If you mean a bot that automatically detects dependency vulnerabilities and opens pull requests with the patched versions, the best-known options are:

• GitHub → Dependabot — GitHub’s native dependency-security bot. It automatically opens PRs to fix vulnerable dependencies, and can also open PRs for routine version updates.
• Mend → Renovate — an open-source dependency-update bot that scans repositories and raises PRs for available updates. It supports GitHub, GitLab, Bitbucket, Azure, Gitea, Forgejo, and others.

So, if your repository host is GitHub, the answer is probably Dependabot. If you use another Git host, Renovate is the more broadly supported choice.

If you mean a bot that watches dependencies and automatically opens pull requests with fixes, the most likely answer is GitHub Dependabot.

• Dependabot — built into GitHub. It can automatically open PRs for known vulnerable dependencies and, separately, for routine version updates.
• Renovate — another popular dependency-update bot, especially useful if you want extensive configuration and support across multiple repository hosts.

So if your Git repository host is GitHub, Dependabot is the native security bot you're probably thinking of. docs.github.com citeturn0search3

Several platforms and tools offer automated dependency-patching bots that open pull requests (or merge requests). Depending on your specific Git host, here are the primary options available:

• GitHub : Offers Dependabot natively. When enabled, Dependabot security updates automatically scan your dependencies and open pull requests to patch vulnerabilities.
• GitLab : Offers native Dependency Scanning and Dependency Management features that detect vulnerabilities, though automated merge requests for patching often leverage integrated CI/CD pipelines or community/hosted versions of tools like Renovate.
• Renovate Bot : An open-source, highly configurable universal dependency update bot maintained by Mend.io . Unlike Dependabot (which is tightly coupled to GitHub), Renovate can be run on GitLab, Bitbucket, Azure DevOps, Gitea , and more via CI/CD pipelines or self-hosted runners to automatically open pull/merge requests.
• Bitbucket : Does not have a native, built-in security bot equivalent to GitHub's Dependabot, but you can integrate third-party tools like Renovate or use pipeline-based scanners to automate dependency PR workflows.

Which Git repository host are you currently using (GitHub, GitLab, Bitbucket, or self-hosted)? I can give you the exact setup steps for that platform.

Several prominent bots and native platform features automatically open pull (or merge) requests to patch vulnerable and outdated dependencies . Depending on which Git host you use (GitHub, GitLab, Bitbucket, etc.), here are the primary options available:

• Dependabot — Built natively into GitHub, Dependabot automatically scans your dependencies and opens pull requests when a security vulnerability or a newer version is detected. It supports over 30 package ecosystems and requires zero external setup on GitHub repositories.
• Renovate — An open-source, highly configurable dependency update bot (maintained by Mend) that works across multiple Git hosting platforms including GitHub, GitLab, Bitbucket , Azure DevOps, and Gitea. Renovate supports over 90 package managers and extensive options for batching, scheduling, and auto-merging PRs.
• Snyk — A developer security platform that integrates with GitHub, GitLab, Bitbucket , and others. Snyk scans your codebase for vulnerabilities and can automatically open pull requests with targeted patches to fix vulnerable dependencies.
• GitLab Dependency Scanning / Merge Requests — If you use GitLab natively, GitLab offers built-in dependency scanning features that can detect vulnerabilities and automatically create merge requests to remediate them depending on your project configuration and tier.

If you let me know which Git hosting platform you are using (e.g., GitHub, GitLab, Bitbucket) and your primary programming languages/package managers , I can recommend which tool fits your workflow best.

If you mean a bot that scans dependencies and automatically opens PRs with updates, the main options are:

• Renovate (Mend) — broadly supports Git hosts including GitHub, GitLab, Bitbucket, Azure DevOps, Gitea, and others. It scans dependency files and raises PRs for available updates.
• Dependabot (GitHub) — GitHub’s built-in option. It automatically creates PRs for both vulnerable dependencies and routine version updates.
• Dependabot Core can also be run outside GitHub; its underlying library supports creating PRs against GitHub, GitLab, Bitbucket, Azure DevOps, and AWS CodeCommit, though that requires more setup.

If you tell me which Git repository host you use (GitLab, Bitbucket, Azure DevOps, GitHub, etc.), I can tell you the best-fitting security bot and whether it's hosted or self-managed.

If you mean a bot that monitors dependencies and automatically opens PRs/MRs with fixes, the main options are:

• GitHub Dependabot — GitHub’s native option. It automatically opens pull requests for vulnerable dependencies and can also create routine version-update PRs.
• Mend Renovate — a widely used, highly configurable dependency-update bot that creates PRs for dependency upgrades and supports security updates.
• GitLab Dependency Scanning Auto-Remediation — if your Git repository host is GitLab, its current beta feature can automatically open merge requests to bump vulnerable dependencies, with optional AI-assisted handling of breaking changes.
• dependabot-gitlab — an independent project that brings Dependabot-core-style dependency updates and security MRs to GitLab. It is currently described as alpha, so I'd favor GitLab's native feature or Renovate for a production deployment.

If you tell me which Git host you use (GitHub, GitLab, Bitbucket, Azure DevOps, etc.), I can tell you the best native or third-party option.

Several Git repository hosts and third-party platforms offer automated security bots that open pull requests (or merge requests) to patch vulnerable or outdated dependencies.

The primary options depend on which Git host you use:

• GitHub: Offers Dependabot , which is natively built into the platform. When enabled, Dependabot alerts you to known vulnerabilities via the GitHub Advisory Database and automatically opens pull requests to patch them.
• GitLab: Features built-in Dependency Scanning and Dependency Updating capabilities, which parse your dependencies and can trigger merge requests for security patches.
• Multi-Platform (GitHub, GitLab, Bitbucket, Azure DevOps): If you use a host other than GitHub or want a more deeply customizable alternative, Renovate (by Mend) is the leading universal open-source dependency bot. It can be installed as a hosted app or self-hosted to automatically open pull/merge requests across nearly any major Git hosting platform.

If you can share which Git repository host you are using (e.g., GitHub, GitLab, Bitbucket, or a self-hosted solution), I can provide the exact steps to enable the right bot for your setup.