Distinguishing between Dependabot security and version update pull requests?

Question

We've had Dependabot enabled for security vulnerabilities on our repos for a while, but just set it up for versioning updates as well. My understanding is that the configuration options for the latter can affect the former as well, particularly when it comes to the metadata options, like setting PR labels or titles.

Given that, is there a way to distinguish between PRs that Dependabot opens for security vulnerabilities versus ones it opens because it's simply out of date, for situations where we want to prioritize the former?

Answer 1

I ran into the exact same problem today. I haven't yet found a way to distinguish between security PRs and out-of-date PRs from the PRs themselves, but I have figured a few things out:

1. Dependabot's Security Alerts have an independent PR limit from ones you set in your dependabot.yml config file. That limit sounds like its hardcoded to 10.
2. If you want to prioritize security alerts, you can more easily do that from the alerts page for your repo: https://github.com/[user]/[repo]/security/dependabot. If Dependabot opened a PR for one of those security updates, it'll have a little pull request icon and link on the right-hand-side of the alert.
3. I think Dependabot won't open a security alert if an existing PR addresses that dependency (it'll tell you as much on the alert page). So if you see that you have security alerts without any generated pull requests, you could try and work through the non-security Dependabot PRs to see if they resolve your security alerts.
4. One final thing to try could be to limit non-security Dependabot to minor and patch versions only. In theory, that'd limit the number of PRs that would both fix a security issue but also be difficult to validate and merge, which could help with prioritization.

I hope this helps! I'm sure I'm missing something as well, so I'll be keen to see other answers to this question.