Dependabot alternative for breaking changes

What Dependabot does well

If your code is on GitHub, Dependabot is already there. GitHub lists Dependabot alerts, security updates and version updates for all plans, and you don't need to buy GitHub Code Security to use them (GitHub docs).

• Version updates. You check a dependabot.yml file into the repository, and Dependabot opens pull requests that move your dependencies to newer versions, even when nothing is vulnerable. For GitHub Actions it updates action and reusable workflow references (GitHub docs).
• Security updates. When a Dependabot alert flags a vulnerable dependency, Dependabot opens a pull request to the lowest version that has the fix and links it to the alert (GitHub docs).
• Grouped updates. The groups setting puts updates for several dependencies in one pull request, so a busy week doesn't mean a pile of separate ones. Security updates can be grouped too, one ecosystem per pull request (version updates, security updates).
• A cooldown. Version updates wait out a cooldown of 3 days by default, which doesn't apply to security updates (GitHub docs).

If your question is whether your packages are current and patched, Dependabot answers it well, and you don't need us for that.

Does Dependabot catch breaking changes?

Not in your code. A Dependabot pull request gives you three signals:

• The changelog and release notes, included in the pull request summary for you to read before you merge (GitHub docs). They say what changed in the package, not where your code uses it.
• Your CI, which runs on the Dependabot branch. Green CI means your tests pass. A removed function in a code path your tests don't cover still goes green.
• For security updates, a compatibility score: the percentage of CI runs that passed when other public repositories made the same update (GitHub docs). It's a useful hint, drawn from other people's code.

None of these read your code to say which file and line a new version breaks. That's usually the gap people mean when they look for a Dependabot alternative.

What Dependabot doesn't cover

Dependabot works on the versions in your manifests and lockfiles. Some of the changes most likely to break production never show up as a new version number.

AI models

A model ID is a string in your code, not a version in a manifest, so no version updater sees it. For example, claude-sonnet-4-5-20250929 retires on the Claude API on November 30, 2026, and requests to it fail after that (Claude deprecations page). Dependabot has nothing to bump. Our guide to tracking AI model retirements covers where each provider and cloud platform publishes its dates.

APIs

When a provider sunsets an endpoint or a request parameter, your code can break without any package changing version, so there is nothing for Dependabot to open. The notice is in the provider's changelog, an email to the account owner, or a response header.

Runtimes and CI runners

Dependabot can bump a Docker base image tag and the actions your workflows use, since docker and github-actions are supported ecosystems (GitHub docs). Its docs don't cover end of life dates, such as a language version losing security fixes or a hosted runner image being retired, so you need another way to see those dates coming.

How to use Dependabot and Since.dev together

Keep Dependabot on. We don't open routine version bumps, so the two don't do the same job.

1. Let Dependabot open its version and security updates as it does now.
2. Before you merge a major-version pull request, have your coding agent call check_code with the package and the new version to see what the release breaks.
3. For a repository you connect, code that would break on the next major version shows up before anyone upgrades, so you know which Dependabot pull requests will need more than a merge.
4. Model retirements, API removals and runtime end of life show up the same way: the file, the line, the days left and the replacement.
5. On Team and up, we open a fix pull request for those changes, built and checked before it opens. Dependabot's pull requests and ours both wait for your review.

When Dependabot alone is enough

Often. If all of these are true, Dependabot plus reading the release notes covers you:

• Your code calls no hosted AI models.
• You call few third-party APIs, and none with announced sunset dates.
• Your tests cover the code paths your dependencies touch.
• You upgrade runtimes and CI images on a schedule anyway.

If the only thing missing is the dates, our free retirement calendar may be all you need. It has iCal and RSS feeds and needs no account.

Where Since.dev fits

Since.dev tracks changes in packages, APIs, AI models and runtimes: breaking releases, deprecations, model retirements and end of life, each recorded from its source. When you scan a public repository (free, no sign-in) or connect one, it finds the exact files and lines a change hits, with the days left and the replacement.

• On Free you get those impacts only. On Team and up, we open fix pull requests that are built and checked before they open (plans).
• Coding agents use it through the MCP server: whats_changed, check_code and fix_code.
• Retirement and end of life dates are free on the calendar, with a keyless API and iCal and RSS feeds.

Fix pull requests open ready for review, your CI runs, and people decide whether to merge. Nothing merges or deploys.

Questions

Is Dependabot free?

Yes. GitHub lists Dependabot alerts, security updates and version updates for all plans, and says you don't need GitHub Code Security to use them (GitHub docs).

Does Dependabot tell you if an update has breaking changes?

Partly. The pull request includes the release notes, your CI runs on the branch, and security updates get a compatibility score from other public repositories' CI runs. It doesn't read your code to say which lines break.

Can Since.dev replace Dependabot?

No, and it doesn't try to. Since.dev doesn't open routine version bumps, so keep Dependabot for keeping versions current. Since.dev covers what Dependabot doesn't: which lines a change hits, and the retirements and end of life dates that aren't version numbers.

Does Dependabot warn about AI model retirements?

No. A model ID is a string in your code, not a package version, so Dependabot has nothing to update. Each provider, and each cloud platform that serves the model, publishes its own retirement dates.

What does Since.dev cost next to Dependabot?

Dependabot is free. Our Free plan shows impacts for one private repository and every public one, and fix pull requests start on Team (pricing). Scanning a public repository needs no account.

Related guides