Allison announces that Dependabot now supports Conda environment files, offering automated security and version updates for Conda-based Python projects and enhancing supply chain security on GitHub.

Dependabot Adds Support for Conda Environment Files

Dependabot can now parse and update environment.yml Conda environment files, adding both security and version update capabilities for Python projects using Conda. This update enables automated dependency management and vulnerability detection for teams relying on Conda-managed environments.

Why It Matters

Many Python teams use Conda to manage project dependencies and isolated environments. With Dependabot’s new support, developers using Conda benefit from:

Automated Security Alerts: Get notified about vulnerabilities in Python packages from the pip GitHub Advisory database.
Automated Dependency Updates: Receive pull requests with the latest dependency versions based on your environment.yml.
Greater Supply Chain Security: Reduce risk by ensuring environments are kept up-to-date and patched.

How It Works

Dependabot detects Conda environment files (environment.yml) in repositories and creates automated pull requests for updates.
Security alerts require submission of a dependency graph using the Dependency Submission API.
Only Python packages dependencies are supported. Security advisories are sourced from GitHub’s pip advisory database.

Availability

Available Today: GitHub.com users can leverage this feature now.
Coming Soon: GitHub Enterprise Server (GHES) support begins with version 3.20.

For further information, documentation and examples are available in the Dependabot documentation. Join the ongoing conversation in the Dependabot Community.

This post appeared first on “The GitHub Blog”. Read the entire article here