Dependabot

When GitHub creates a Dependabot alert, Mogplex can start an agent that prepares the smallest safe dependency fix and opens a PR for review. GitHub still detects vulnerabilities and decides when an alert is fixed.

RequirementsCopy Anchor Link

• The GitHub integration is connected, and the Mogplex GitHub App is installed on the repository.
• Dependabot alerts are turned on for the repository in GitHub.
• The GitHub App has the Dependabot alerts: Read-only permission and subscribes to the Dependabot alert event. The hosted Mogplex App already has both. For a self-hosted App, see GitHub App setup. Each installation must accept new permissions.

Set it upCopy Anchor Link

1. Open Automations and create a workflow from the Dependabot autopilot template.
2. Select the GitHub installation, the repository scope, the agent, and the model.
3. Publish the workflow.
4. Optional: after you confirm that it works, turn off Dependabot security updates in GitHub, so that Mogplex is the only tool that opens remediation PRs. Keep Dependabot alerts on.

What the agent doesCopy Anchor Link

1. Reads the alert from GitHub. If the alert is already closed, the agent stops. If no patched version exists, the agent reports that the alert needs a human decision.
2. Checks open PRs to avoid duplicate work.
3. Uses the repository's own package manager to make the smallest manifest and lockfile change.
4. Runs the available install, lint, typecheck, test, and build checks.
5. Opens a PR that lists the alert, GHSA and CVE IDs, severity, package, old and new versions, and check results.

The agent never merges the PR and never dismisses the alert. Major upgrades, risky indirect dependency changes, and failed checks are reported for a human to decide.

Alert eventsCopy Anchor Link

The workflow start node can match created, dismissed, fixed, reopened, reintroduced, and auto_dismissed. The template selects only created.

• An omitted action list also means created. An empty list matches nothing.
• The other actions record the alert's state. They do not start remediation, close PRs, or cancel runs.
• Each GitHub delivery starts each matching workflow at most once. Redelivering the same event does not create a second run.

VerifyCopy Anchor Link

In the GitHub App's Advanced → Recent deliveries, find a dependabot_alert.created delivery and confirm that it started one run in Observability.