Use Emendant with Dependabot
Use Dependabot to propose the version change. Use Emendant to see which of your call sites a supported release changed, and to check a possible patch before you merge.
Emendant does not update dependency versions and does not replace Dependabot. It reads the versions in your checkout and your source code. You run it in the Dependabot branch. No hosted integration is needed.
What each tool does
| Work | Dependabot | Emendant |
|---|---|---|
| Propose dependency updates | Opens version-update and security-update pull requests. | Reads dependency versions to pick the relevant feed changes. |
| Help review an upgrade | Includes release notes and changelog information. | Links supported changes to affected source locations and release evidence. |
| Prepare source changes | You review the update PR and its checks. | Offers eligible deterministic patches. Assisted fixes need a model provider you select. Some findings have no patch. |
| Check the result | GitHub recommends automated tests before you merge. | Runs discovered or configured typecheck and test commands on a patched copy, and reports an evidence grade. |
The workflow
- Read the Dependabot PR. Note the package, the old and new version, and any related packages that must move together.
- Scan before the update. On the base branch, with Node.js 20 or later:
Relevant changes ahead of the installed version show asnpx emendant feed update npx emendant scan --package openaipending. - Scan the Dependabot branch. Once the lockfile names the new release, include adopted changes:
npx emendant scan --package openai --adopted - Preview patches.
A dry run checks edits in memory. It does not call a model or run your checks.npx emendant fix --package openai --adopted --dry-run - Generate patches and read the report. Remove
--dry-run. Read.emendant/report.mdand each patch. A check that did not run is not a pass. - Merge the source patches with the dependency update as one migration. Run your typecheck, tests, lint and build first.
Coverage. Emendant reports the changes in its feed. A clean scan does not show that an upgrade is complete. See supported projects and known limitations.
The full guide is Use Emendant alongside Dependabot. See also Emendant and Dependabot compared.
Sources
Other tools' behaviour was checked against their own documentation on 13 November 2026.