GitHub

Dependabot (PHP Composer dependencies)

Response status

Not listed

Response information checked

2026-10-27

Current re-audit: Official sources searched; no response found · Research date: 2026-10-27

Provides source hosting, CI and dependency updates.

Dependabot supports Composer dependencies. Package updates are separate from updating PHP on servers or Actions runners.

Scope: An incident-specific response is not listed. Composer dependency updates are separate from PHP runtime remediation.

What users should do

Check and update composer.lock, the PHP configuration in Actions, container base images and PHP on the deployment server.

Official service URL

• https://github.com/

Source URLs

1. Ecosystems supported by Dependabothttps://docs.github.com/en/code-security/reference/supply-chain-security/supported-ecosystems-and-repositoriesService and operation documentation
2. https://github.blog/security/https://github.blog/security/Service and operation documentation