Dependabot version updates now support Bazel - GitHub Changelog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/github.blog\/changelog\/2025-12-16-dependabot-version-updates-now-support-bazel\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Dependabot version updates now support Bazel \u00b7 GitHub Changelog\" \/>\n<meta property=\"og:description\" content=\"Developers can now use Dependabot to automatically keep their Bazel dependencies up to date. For projects that use Bazel—either Bzlmod or WORKSPACE—Dependabot version updates can now ensure dependencies stay current…\" \/>\n<meta property=\"og:url\" content=\"https:\/\/github.blog\/changelog\/2025-12-16-dependabot-version-updates-now-support-bazel\/\" \/>\n<meta property=\"og:site_name\" content=\"The GitHub Blog\" \/>\n<meta property=\"article:modified_time\" content=\"2025-12-16T16:49:26+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/github.blog\/wp-content\/uploads\/2024\/08\/d34e9c19123898a8a886147f37a1d167130d1c15be6d399a9c4b30ee6f2a7395-1200x630-1.png?fit=1200%2C630\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"2 minutes\" \/>\n\t<meta name=\"twitter:label2\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data2\" content=\"Allison\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/github.blog\\\/changelog\\\/2025-12-16-dependabot-version-updates-now-support-bazel\\\/\",\"url\":\"https:\\\/\\\/github.blog\\\/changelog\\\/2025-12-16-dependabot-version-updates-now-support-bazel\\\/\",\"name\":\"Dependabot version updates now support Bazel - The GitHub Blog\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/github.blog\\\/#website\"},\"datePublished\":\"2025-12-16T16:45:50+00:00\",\"dateModified\":\"2025-12-16T16:49:26+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/github.blog\\\/changelog\\\/2025-12-16-dependabot-version-updates-now-support-bazel\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/github.blog\\\/changelog\\\/2025-12-16-dependabot-version-updates-now-support-bazel\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/github.blog\\\/changelog\\\/2025-12-16-dependabot-version-updates-now-support-bazel\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/github.blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Changelogs\",\"item\":\"https:\\\/\\\/github.blog\\\/changelog\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Dependabot version updates now support Bazel\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/github.blog\\\/#website\",\"url\":\"https:\\\/\\\/github.blog\\\/\",\"name\":\"The GitHub Blog\",\"description\":\"Updates, ideas, and inspiration from GitHub to help developers build and design software.\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/github.blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"}]}<\/script>\n","yoast_head_json":{"title":"Dependabot version updates now support Bazel - GitHub Changelog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/github.blog\/changelog\/2025-12-16-dependabot-version-updates-now-support-bazel\/","og_locale":"en_US","og_type":"article","og_title":"Dependabot version updates now support Bazel \u00b7 GitHub Changelog","og_description":"Developers can now use Dependabot to automatically keep their Bazel dependencies up to date. For projects that use Bazel—either Bzlmod or WORKSPACE—Dependabot version updates can now ensure dependencies stay current…","og_url":"https:\/\/github.blog\/changelog\/2025-12-16-dependabot-version-updates-now-support-bazel\/","og_site_name":"The GitHub Blog","article_modified_time":"2025-12-16T16:49:26+00:00","og_image":[{"width":1200,"height":630,"url":"https:\/\/github.blog\/wp-content\/uploads\/2024\/08\/d34e9c19123898a8a886147f37a1d167130d1c15be6d399a9c4b30ee6f2a7395-1200x630-1.png?fit=1200%2C630","type":"image\/png"}],"twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"2 minutes","Written by":"Allison"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/github.blog\/changelog\/2025-12-16-dependabot-version-updates-now-support-bazel\/","url":"https:\/\/github.blog\/changelog\/2025-12-16-dependabot-version-updates-now-support-bazel\/","name":"Dependabot version updates now support Bazel - The GitHub Blog","isPartOf":{"@id":"https:\/\/github.blog\/#website"},"datePublished":"2025-12-16T16:45:50+00:00","dateModified":"2025-12-16T16:49:26+00:00","breadcrumb":{"@id":"https:\/\/github.blog\/changelog\/2025-12-16-dependabot-version-updates-now-support-bazel\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/github.blog\/changelog\/2025-12-16-dependabot-version-updates-now-support-bazel\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/github.blog\/changelog\/2025-12-16-dependabot-version-updates-now-support-bazel\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/github.blog\/"},{"@type":"ListItem","position":2,"name":"Changelogs","item":"https:\/\/github.blog\/changelog\/"},{"@type":"ListItem","position":3,"name":"Dependabot version updates now support Bazel"}]},{"@type":"WebSite","@id":"https:\/\/github.blog\/#website","url":"https:\/\/github.blog\/","name":"The GitHub Blog","description":"Updates, ideas, and inspiration from GitHub to help developers build and design software.","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/github.blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"}]}},"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/github.blog\/wp-json\/wp\/v2\/changelogs\/92850","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/github.blog\/wp-json\/wp\/v2\/changelogs"}],"about":[{"href":"https:\/\/github.blog\/wp-json\/wp\/v2\/types\/changelog"}],"author":[{"embeddable":true,"href":"https:\/\/github.blog\/wp-json\/wp\/v2\/users\/2106"}],"version-history":[{"count":1,"href":"https:\/\/github.blog\/wp-json\/wp\/v2\/changelogs\/92850\/revisions"}],"predecessor-version":[{"id":92852,"href":"https:\/\/github.blog\/wp-json\/wp\/v2\/changelogs\/92850\/revisions\/92852"}],"wp:attachment":[{"href":"https:\/\/github.blog\/wp-json\/wp\/v2\/media?parent=92850"}],"wp:term":[{"taxonomy":"changelog-type","embeddable":true,"href":"https:\/\/github.blog\/wp-json\/wp\/v2\/type?post=92850"},{"taxonomy":"changelog-label","embeddable":true,"href":"https:\/\/github.blog\/wp-json\/wp\/v2\/label?post=92850"},{"taxonomy":"changelog-group","embeddable":true,"href":"https:\/\/github.blog\/wp-json\/wp\/v2\/group?post=92850"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/github.blog\/wp-json\/wp\/v2\/coauthors?post=92850"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":92850,"date":"2025-12-16T08:45:50","date_gmt":"2025-12-16T16:45:50","guid":{"rendered":"https:\/\/github.blog\/changelog\/2025-12-16-dependabot-version-updates-now-support-bazel"},"modified":"2025-12-16T08:49:26","modified_gmt":"2025-12-16T16:49:26","slug":"dependabot-version-updates-now-support-bazel","status":"publish","type":[3521],"link":"https:\/\/github.blog\/changelog\/2025-12-16-dependabot-version-updates-now-support-bazel","title":{"rendered":"Dependabot version updates now support Bazel"},"content":{"rendered":"\n

Developers can now use Dependabot to automatically keep their Bazel dependencies up to date. For projects that use Bazel—either Bzlmod or WORKSPACE—Dependabot version updates can now ensure dependencies stay current with the latest releases.<\/p>\n

A huge thanks to the Bazel team for their contributions and collaboration bringing support to Dependabot.<\/p>\n

Background<\/span><\/a><\/h2>\n
The open source community’s top requests for Bazel support for Dependabot<\/a> included:<\/p>\n
\n
Proper lockfile generation<\/li>\n
`.MODULE.bazel<\/code> support<\/li>\n`
WORKSPACE support (still widely used despite upcoming deprecation)<\/li>\n<\/ul>\nBazel uses two dependency systems, both the modern Bzlmod system (MODULE.bazel<\/code> files) and the legacy WORKSPACE system. Community feedback showed many teams still rely on WORKSPACE, so we built support for both. Additionally, Bazel’s MODULE.bazel.lock<\/code> files capture complex transitive dependency graphs, including module extensions and repository rules. Incorrect lockfile generation breaks reproducible builds, so we worked closely with the Bazel community to get this right.<\/p>\nCommunity partnership<\/span><\/a><\/h2>\nThe Bazel community provided critical guidance:<\/p>\n\nFabian Meumertzheim:<\/strong> Lockfile semantics and behavior matching<\/li>\n Yun Peng:<\/strong> Testing, validation, and implementation data<\/li>\nAlex Eagle:<\/strong> File naming conventions and .MODULE.bazel<\/code> patterns<\/li>\n<\/ul>\nThank you especially to these folks, and to everyone who tested and provided feedback during our preview support for this ecosystem.<\/p>\nHow it works<\/span><\/a><\/h2>\n\nDependency detection:<\/strong> Dependabot scans your MODULE.bazel<\/code>, *.MODULE.bazel<\/code>, or WORKSPACE files and checks the Bazel central registry for updates. <\/li>\n Lockfile management:<\/strong> Dependabot regenerates lockfiles to maintain reproducible builds. <\/li>\nPull requests:<\/strong> Dependabot opens pull requests with updated declarations, regenerated lockfiles, release notes, and compatibility information.<\/li>\n<\/ol>\nGetting started<\/span><\/a><\/h2>\nRequirements include:<\/p>\n\nBazel 7, 8, or 9<\/li>\n \nA MODULE.bazel<\/code> or WORKSPACE<\/code> file at the repository root<\/p>\n<\/li>\n\nEngage with the Dependabot open source community<\/a> on the topic of Bazel support.<\/p>\n<\/li>\n Learn more in our Dependabot version updates documentation<\/a>.<\/li>\n Learn more about Bazel<\/a>.<\/li>\n<\/ul>\n<\/body><\/html>\n","protected":false},"excerpt":{"rendered":"Developers can now use Dependabot to automatically keep their Bazel dependencies up to date. For projects that use Bazel—either Bzlmod or WORKSPACE—Dependabot version updates can now ensure dependencies stay current…<\/p>\n","protected":false},"author":2106,"featured_media":0,"template":"","meta":{"_gh_post_show_toc":"","_gh_post_is_no_robots":"","_gh_post_is_featured":"","_gh_post_is_excluded":"","_gh_post_is_unlisted":"","_gh_post_related_link_1":"","_gh_post_related_link_2":"","_gh_post_related_link_3":"","_gh_post_sq_img":"","_gh_post_sq_img_id":"","_gh_post_cta_title":"","_gh_post_cta_text":"","_gh_post_cta_link":"","_gh_post_cta_button":"","_gh_post_recirc_hide":"","_gh_post_recirc_col_1":"","_gh_post_recirc_col_2":"","_gh_post_recirc_col_3":"","_gh_post_recirc_col_4":"","_featured_video":"","_gh_post_additional_query_params":"","footnotes":"","_links_to":"","_links_to_target":"","primary_cta":"","primary_cta_url":"","secondary_cta":"","secondary_cta_url":""},"label":[3630],"group":[3773],"coauthors":[3100],"class_list":["post-92850","changelog","type-changelog","status-publish","hentry","changelog-type-new-releases","changelog-label-supply-chain-security","changelog-group-12-2025"],"yoast_head":"\nDependabot version updates now support Bazel - GitHub Changelog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/github.blog\/changelog\/2025-12-16-dependabot-version-updates-now-support-bazel\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Dependabot version updates now support Bazel \u00b7 GitHub Changelog\" \/>\n<meta property=\"og:description\" content=\"Developers can now use Dependabot to automatically keep their Bazel dependencies up to date. For projects that use Bazel—either Bzlmod or WORKSPACE—Dependabot version updates can now ensure dependencies stay current…\" \/>\n<meta property=\"og:url\" content=\"https:\/\/github.blog\/changelog\/2025-12-16-dependabot-version-updates-now-support-bazel\/\" \/>\n<meta property=\"og:site_name\" content=\"The GitHub Blog\" \/>\n<meta property=\"article:modified_time\" content=\"2025-12-16T16:49:26+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/github.blog\/wp-content\/uploads\/2024\/08\/d34e9c19123898a8a886147f37a1d167130d1c15be6d399a9c4b30ee6f2a7395-1200x630-1.png?fit=1200%2C630\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"2 minutes\" \/>\n\t<meta name=\"twitter:label2\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data2\" content=\"Allison\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/github.blog\\\/changelog\\\/2025-12-16-dependabot-version-updates-now-support-bazel\\\/\",\"url\":\"https:\\\/\\\/github.blog\\\/changelog\\\/2025-12-16-dependabot-version-updates-now-support-bazel\\\/\",\"name\":\"Dependabot version updates now support Bazel - The GitHub Blog\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/github.blog\\\/#website\"},\"datePublished\":\"2025-12-16T16:45:50+00:00\",\"dateModified\":\"2025-12-16T16:49:26+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/github.blog\\\/changelog\\\/2025-12-16-dependabot-version-updates-now-support-bazel\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/github.blog\\\/changelog\\\/2025-12-16-dependabot-version-updates-now-support-bazel\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/github.blog\\\/changelog\\\/2025-12-16-dependabot-version-updates-now-support-bazel\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/github.blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Changelogs\",\"item\":\"https:\\\/\\\/github.blog\\\/changelog\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Dependabot version updates now support Bazel\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/github.blog\\\/#website\",\"url\":\"https:\\\/\\\/github.blog\\\/\",\"name\":\"The GitHub Blog\",\"description\":\"Updates, ideas, and inspiration from GitHub to help developers build and design software.\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/github.blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"}]}<\/script>\n","yoast_head_json":{"title":"Dependabot version updates now support Bazel - GitHub Changelog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/github.blog\/changelog\/2025-12-16-dependabot-version-updates-now-support-bazel\/","og_locale":"en_US","og_type":"article","og_title":"Dependabot version updates now support Bazel \u00b7 GitHub Changelog","og_description":"Developers can now use Dependabot to automatically keep their Bazel dependencies up to date. For projects that use Bazel—either Bzlmod or WORKSPACE—Dependabot version updates can now ensure dependencies stay current…","og_url":"https:\/\/github.blog\/changelog\/2025-12-16-dependabot-version-updates-now-support-bazel\/","og_site_name":"The GitHub Blog","article_modified_time":"2025-12-16T16:49:26+00:00","og_image":[{"width":1200,"height":630,"url":"https:\/\/github.blog\/wp-content\/uploads\/2024\/08\/d34e9c19123898a8a886147f37a1d167130d1c15be6d399a9c4b30ee6f2a7395-1200x630-1.png?fit=1200%2C630","type":"image\/png"}],"twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"2 minutes","Written by":"Allison"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/github.blog\/changelog\/2025-12-16-dependabot-version-updates-now-support-bazel\/","url":"https:\/\/github.blog\/changelog\/2025-12-16-dependabot-version-updates-now-support-bazel\/","name":"Dependabot version updates now support Bazel - The GitHub Blog","isPartOf":{"@id":"https:\/\/github.blog\/#website"},"datePublished":"2025-12-16T16:45:50+00:00","dateModified":"2025-12-16T16:49:26+00:00","breadcrumb":{"@id":"https:\/\/github.blog\/changelog\/2025-12-16-dependabot-version-updates-now-support-bazel\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/github.blog\/changelog\/2025-12-16-dependabot-version-updates-now-support-bazel\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/github.blog\/changelog\/2025-12-16-dependabot-version-updates-now-support-bazel\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/github.blog\/"},{"@type":"ListItem","position":2,"name":"Changelogs","item":"https:\/\/github.blog\/changelog\/"},{"@type":"ListItem","position":3,"name":"Dependabot version updates now support Bazel"}]},{"@type":"WebSite","@id":"https:\/\/github.blog\/#website","url":"https:\/\/github.blog\/","name":"The GitHub Blog","description":"Updates, ideas, and inspiration from GitHub to help developers build and design software.","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/github.blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"}]}},"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/github.blog\/wp-json\/wp\/v2\/changelogs\/92850","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/github.blog\/wp-json\/wp\/v2\/changelogs"}],"about":[{"href":"https:\/\/github.blog\/wp-json\/wp\/v2\/types\/changelog"}],"author":[{"embeddable":true,"href":"https:\/\/github.blog\/wp-json\/wp\/v2\/users\/2106"}],"version-history":[{"count":1,"href":"https:\/\/github.blog\/wp-json\/wp\/v2\/changelogs\/92850\/revisions"}],"predecessor-version":[{"id":92852,"href":"https:\/\/github.blog\/wp-json\/wp\/v2\/changelogs\/92850\/revisions\/92852"}],"wp:attachment":[{"href":"https:\/\/github.blog\/wp-json\/wp\/v2\/media?parent=92850"}],"wp:term":[{"taxonomy":"changelog-type","embeddable":true,"href":"https:\/\/github.blog\/wp-json\/wp\/v2\/type?post=92850"},{"taxonomy":"changelog-label","embeddable":true,"href":"https:\/\/github.blog\/wp-json\/wp\/v2\/label?post=92850"},{"taxonomy":"changelog-group","embeddable":true,"href":"https:\/\/github.blog\/wp-json\/wp\/v2\/group?post=92850"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/github.blog\/wp-json\/wp\/v2\/coauthors?post=92850"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

Community partnership<\/span><\/a><\/h2>\nThe Bazel community provided critical guidance:<\/p>\n\nFabian Meumertzheim:<\/strong> Lockfile semantics and behavior matching<\/li>\nYun Peng:<\/strong> Testing, validation, and implementation data<\/li>\n

Getting started<\/span><\/a><\/h2>\nRequirements include:<\/p>\n\nBazel 7, 8, or 9<\/li>\n\nA MODULE.bazel<\/code> or WORKSPACE<\/code> file at the repository root<\/p>\n<\/li>\n