Skip to main content

CI005-no-dependabot

Dimension: ci_release Default severity: Low Languages: Rust (project-level) CWE: (none)

What it detects​

Fires when .github/dependabot.yml (or .github/dependabot.yaml) does not exist in the project root.

Why it matters​

Dependabot automatically opens pull requests to keep dependencies up to date, including security patches. Without it, dependency updates are entirely manual and may be delayed — increasing exposure to known vulnerabilities.

Example — flagged​

No .github/dependabot.yml file exists.

Example — not flagged​

# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: "cargo"
    directory: "/"
    schedule:
      interval: "weekly"

Fix guidance​

Create .github/dependabot.yml:

version: 2
updates:
  - package-ecosystem: "cargo"
    directory: "/"
    schedule:
      interval: "weekly"
    open-pull-requests-limit: 10

This enables weekly PRs for all Cargo dependencies. Adjust interval and open-pull-requests-limit to match your workflow.

References​