Dependabot Now Supports uv
As of March 13, 2025, Dependabot officially supports uv.
Dependabot monitors repositories for outdated or insecure dependencies and creates pull requests to update them. GitHub’s tool supports npm, pip, Maven, Docker, and now uv.
Note
Update 2026-09-09: Dependabot security updates now support uv as well, so a vulnerability in a uv.lock dependency opens a security alert and a fix pull request, not just a version-update one.
Learn More
Last updated on
Why Doesn't the Authoritative Python Packaging Guide Mention the Best Thing that's Happened to Python Packaging?Setuptools 78.0.1 breaking package installation