Dependabot version updates now support Bazel

Source: GitHub Changelog

Overview

Developers can now use Dependabot to automatically keep their Bazel dependencies up to date. For projects that use Bazel—either Bzlmod or WORKSPACE—Dependabot version updates can ensure dependencies stay current with the latest releases.

A huge thanks to the Bazel team for their contributions and collaboration bringing support to Dependabot.

Background

The open‑source community’s top requests for Bazel support for Dependabot included:

• Proper lockfile generation
• *.MODULE.bazel support
• WORKSPACE support (still widely used despite upcoming deprecation)

Bazel uses two dependency systems:

1. Bzlmod – modern system using MODULE.bazel files.
2. WORKSPACE – legacy system that remains in use.

Community feedback showed many teams still rely on WORKSPACE, so support for both was built. Bazel’s MODULE.bazel.lock files capture complex transitive dependency graphs, including module extensions and repository rules. Incorrect lockfile generation breaks reproducible builds, so the GitHub team worked closely with the Bazel community to get this right.

Community contributors

• Fabian Meumertzheim – lockfile semantics and behavior matching
• Yun Peng – testing, validation, and implementation data
• Alex Eagle – file naming conventions and *.MODULE.bazel patterns

Thanks to these contributors and everyone who tested and provided feedback during the preview support phase.

How it works

• Dependency detection – Dependabot scans your MODULE.bazel, *.MODULE.bazel, or WORKSPACE files and checks the Bazel central registry for updates.
• Lockfile management – Dependabot regenerates lockfiles to maintain reproducible builds.
• Pull requests – Dependabot opens PRs with updated declarations, regenerated lockfiles, release notes, and compatibility information.

Getting started

Requirements

• Bazel 7, 8, or 9
• A MODULE.bazel or WORKSPACE file at the repository root

Next steps

• Engage with the Dependabot open‑source community on Bazel support.
• Learn more in the Dependabot version updates documentation.
• Learn more about Bazel.