Dispatches / a short note
Dependabot's inner workings
Painstaking bandwidth intensive process
Statelessness means someone has to track state.
Wow, well said. The opensource part of dependabot is 900k lines ruby wrapper over github’s proprietary code. The unmerged PR tracking, merge conflict resolution, rebase, and several coordination / scheduling parts of the logic are kept private (unlike githlab).
site: https://nesbitt.io/2026/01/02/how-dependabot-actually-works.html
Dependabot PRs all over the world: https://dependabot.ecosyste.ms/ (lol, just 9% merge rate!?, actually that makes sense. when have I ever taken dependabot PR seriously).