January 10, 2026

Fix Dependabot Security Alerts That Don't Open Pull Requests

Alex Smolen

Archived (May 2026): GitHub shipped native Dependabot alert assignment to AI agents in April 2026, which covers the same gap this project was built to address. Leaving the post up for context, but dependabot-wolf is no longer needed.

Dependabot catches security vulnerabilities and opens pull requests to fix them. Except when it doesn’t. If Dependabot can’t create a PR for a security alert, dependabot-wolf automatically sends the details to Copilot to figure it out. It’s a GitHub Action that monitors Dependabot security alerts and automatically sends any without PRs to GitHub Copilot for resolution.

How it works:

Checks for Dependabot security alerts that don’t have pull requests
Extracts the vulnerability details and dependency conflict information
Sends the context to an issue and assigns Copilot

You need to create a fine-grained PAT and put it as an Action secret with perms to create an issue and assign to Copilot.

Installation

Add the action to your repository’s workflow:

name: Dependabot Wolf
on:
  schedule:
    - cron: '0 0 * * *'  # Daily check
  workflow_dispatch:

jobs:
  check-dependabot:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: read
      issues: write
    steps:
      - uses: engseclabs/dependabot-wolf@v1

Found this useful? Check out the repo or let me know if you run into issues.

About the author

Alex Smolen is a security engineer and the founder of EngSecLabs, a security consulting practice focused on practical security programs for growing companies. He works directly with engineering and product teams on security architecture, AI security, and compliance.

If you're working through a security problem, get in touch.