Pharon and Dependabot
Updated October 29, 2026
Pharon and Dependabot in short
Dependabot keeps the dependencies in a GitHub repository patched: it alerts on advisories and opens pull requests that update them. Pharon watches the rest of the stack too, from base images to the vendors you depend on, and tells you whether a laptop or CI runner actually installed a bad release. Most teams should run both.
Side by side
| Dependabot | Pharon | |
|---|---|---|
| What it scans | The dependency graph GitHub builds from a repository's manifests and lockfiles, on the default branch, including GitHub Actions pinned to a version (not to a commit) | Lockfiles, manifests, Dockerfiles, compose and workflow files, runtime version files and your cloud CLI, read on your machine or in your CI |
| Malicious packages | Yes, when malware alerts are enabled: Composer, Go, Maven, npm, NuGet, pip, RubyGems and Rust, from GitHub-reviewed advisories | Yes, from OSV.dev and OpenSSF's malicious-packages reports, for npm, PyPI, Go, crates.io, RubyGems, Packagist, Maven, NuGet and GitHub Actions |
| Vulnerabilities | Advisories from the GitHub Advisory Database | High and critical advisories from the last 30 days, and any vulnerability on CISA's exploited list |
| End-of-life runtimes and services | Not documented | Yes, for runtimes, databases, Kubernetes, EKS and RDS, from endoflife.date |
| Vendor and SaaS breaches | Not documented | Yes, from security news and vendor bulletins |
| Was this machine affected? | Not documented: alerts are per repository | Yes: a read-only local check reports, per location, whether the bad version is or was installed |
| Secrets to rotate | Not documented | Yes, by name, never their values |
| Fix pull requests | Yes (security updates) | No |
| Where alerts go | The repository's Security tab, GitHub notifications and email digests, GitHub Mobile, warnings on git push, and a webhook event | Email, Slack, webhooks, Claude Code sessions, a GitHub pull request check and a dashboard |
| Access to your code | Runs on GitHub against the repository's contents | None: only names and versions are uploaded |
Facts about Dependabot come from its documentation, checked on October 29, 2026. "Not documented" means we couldn't find the feature in its docs.
What Dependabot does that Pharon doesn't
- Opens pull requests that update vulnerable dependencies
- Reachability analysis (public preview, for npm, pnpm and Yarn)
- Free on all GitHub plans
Using both
Keep Dependabot for updates and patching. Add Pharon for compromises across images, CI actions, runtimes, cloud services and vendors, and for the question Dependabot doesn't answer: did any of our machines install it, and what do we rotate?
Sources
Also compared: Snyk and Socket. Read the docs to try Pharon.