What triggers Dependabot to create a pull request?

Two distinct triggers exist, matching Dependabot's two core features. For version updates, the trigger is simply the scheduled check (daily/weekly/monthly, per your configuration) finding that a newer version of a monitored dependency is available. For security updates, the trigger is the dependency graph matching against a newly published (or newly relevant) entry in the GitHub Advisory Database.

flowchart TD
    A[Scheduled check per dependabot.yml] --> B{Newer version available?}
    B -->|Yes| C[Version update PR opened]

    D[New security advisory published] --> E{Repo depends on affected version?}
    E -->|Yes| F[Security update PR opened]

Security update PRs can appear at any time, independent of your configured schedule, since they're event-driven by advisory publication rather than tied to a fixed check interval — a genuinely critical vulnerability doesn't wait for your next scheduled weekly check to be addressed.

Invest now in Acorns!!! 🚀
Join Acorns and get your $5 bonus!

Acorns is a micro-investing app that automatically invests your "spare change" from daily purchases into diversified, expert-built portfolios of ETFs. It is designed for beginners, allowing you to start investing with as little as $5. The service automates saving and investing. Disclosure: I may receive a referral bonus.

Invest now!!! Get Free equity stock (US, UK only)!

Use Robinhood app to invest in stocks. It is safe and secure. Use the Referral link to claim your free stock when you sign up!.

The Robinhood app makes it easy to trade stocks, crypto and more.

Webull! Receive free stock by signing up using the link: Webull signup.