How does Dependabot detect vulnerable dependencies?

Dependabot cross-references a repository's dependency graph against the GitHub Advisory Database — a curated, continuously updated collection of known security vulnerabilities (sourced from the National Vulnerability Database, GitHub's own security research, and community-reported advisories) affecting specific package versions.

flowchart LR
    A[Repository's dependency graph] --> B{Any dependency version matches a GitHub Advisory Database entry?}
    B -->|Yes| C[Dependabot alert generated]
    B -->|No| D[No alert - continue normal monitoring]

Whenever a new advisory is published (or an existing dependency version is newly found to be vulnerable), GitHub automatically checks every repository's dependency graph against it, and any match triggers an alert — meaning detection isn't limited to only checking at the moment you add a dependency; it's an ongoing process that surfaces newly discovered vulnerabilities in dependencies you've had in place for a long time too.