How do routine updates and security updates differ?

Routine version updates propose newer package versions according to your configuration. Security updates are a separate feature that can propose updates for known issues. The pull request is a proposed change. Review it and run your usual tests before merging.

What does Dependabot need to find your packages?

Version updates use a repository configuration that tells GitHub the package system, location and schedule. If packages are in a private registry, confirm the bot has only the access it needs. Keep the configuration and package lockfile with the project.

Can a private repository use routine updates?

GitHub lists version updates for all GitHub repositories. Check charges for the automated tests that run after a pull request, and check the separate settings for alerts and security updates.

What would you check before merging an update to your app’s email package?

Draw one hypothetical pull request that changes an email package and its lockfile. Leave the actual repository and email service untouched.

Read the proposal
Record which package and version changed, and identify one expected effect from the release notes.
Choose the evidence
Write which existing checks should pass and what would make you ask for a manual review.