# GitHub Dependabot: how AI models rank it, November 2026

Gane Index, November 2026 Edition. Named in 25 judge labels across 1 category by 12 of 14 models. Page: https://www.gane.ai/index/it/vendors/github-dependabot

## Standing by category

| Category | Share | Rank | Negative rate | Labels |
|---|---|---|---|---|
| [Software composition analysis](https://www.gane.ai/index/it/developer/software-composition-analysis/index.md) | 8% | 4 | 24% | 25 |

## What the models said for it

- "Using GitHub and want zero setup effort | GitHub Dependabot | Free, native, automatically creates fix PRs." (Gemini 3.5 Flash, SCA)
- "Best value for most budget-conscious companies: GitHub Dependabot—if your code is already on GitHub." (GPT-6 Luna, SCA)
- "GitHub Dependabot or Snyk Open Source are the best starting points due to their free tiers" (Mistral Small, SCA)
- "enable GitHub Dependabot today + run OWASP Dependency-Check or Trivy locally in CI" (Muse Glimmer 30B, SCA)

## And against it

- "GitHub Dependabot as your entire SCA program: It can be useful for repositories on GitHub, but check the documented ecosystem and file-format coverage" (GPT-6 Luna, SCA)
- "May be insufficient as a standalone program for complex SBOM, license, or multi-repository governance" (Perplexity Sonar, SCA)
- "Dependabot is convenient if you're all-in on GitHub, but it's more of an updater than a deep scanner." (Grok 4.20, SCA)
- "Less sophisticated than dedicated SCA tools; limited license compliance and policy features" (DeepSeek V4 Flash, SCA)

## By model

| Model | First choice | Alternative | Mention | Warning | Labels |
|---|---|---|---|---|---|
| Claude Haiku 4.5 | 0 | 1 | 0 | 0 | 1 |
| GPT-5.4 mini | 0 | 0 | 0 | 0 | 0 |
| Gemini 3.5 Flash | 1 | 1 | 0 | 0 | 2 |
| Perplexity Sonar | 0 | 2 | 0 | 1 | 3 |
| Grok 4.20 | 0 | 0 | 1 | 1 | 2 |
| Mistral Small | 1 | 1 | 0 | 0 | 2 |
| DeepSeek V4 Flash | 0 | 1 | 0 | 2 | 3 |
| Llama 4 Maverick | 0 | 0 | 1 | 0 | 1 |
| Qwen 3.7 Flash | 0 | 0 | 0 | 0 | 0 |
| Kimi K2 | 0 | 2 | 0 | 0 | 2 |
| GLM 4.7 FlashX | 0 | 1 | 0 | 0 | 1 |
| MiniMax M2.5 | 0 | 0 | 2 | 1 | 3 |
| GPT-6 Luna | 1 | 2 | 0 | 1 | 4 |
| Muse Glimmer 30B | 1 | 0 | 0 | 0 | 1 |

## Sources returned with these answers

The sites and pages cited by the answers that named GitHub Dependabot, from 51 of the 61 answers that named it (only the models that return a source list).

### Domains cited

- github.com: 18 (its own site)
- blog.jetbrains.com: 15
- dupple.com: 15
- safeguard.sh: 15
- checkmarx.com: 14
- g2.com: 14
- linuxfoundation.org: 12
- raven.io: 12
- sonatype.com: 12
- res.cloudinary.com: 11

### Pages cited

- https://blog.jetbrains.com/qodana/2025/09/best-software-composition-analysis-tools: 15
- https://dupple.com/learn/best-software-composition-analysis-tools: 15
- https://checkmarx.com/learn/sca/sca-tools-key-capabilities-11-tools-to-watch-in-2026: 12
- https://linuxfoundation.org/hubfs/Reports/An-Open-Guide-To-Evaluating-Software-Composition-Analysis-Tools_V2.pdf: 12
- https://raven.io/blog/best-software-composition-analysis-tools: 12
- https://res.cloudinary.com/snyk/image/upload/v1731508416/website-pdfs/The-Forrester-Wave-Software-Composition-Analysis-Software-Q4-2024.pdf: 11
- https://itechguides.com/best/software-composition-analysis-software: 10
- https://seemplicity.ai/faqs/what-are-the-top-10-sca-tools: 10

## In its own words

What GitHub Dependabot's own pages state, read 2026-10-05. Stated by the vendor, not checked by the index.

- Certifications: SOC 2, GDPR
- Customers named: SAP, Otto Group, SPH Media, Postmates

## Record

- Method: https://www.gane.ai/index/it/methodology
- License: CC BY 4.0. Cite as Gane Index, November 2026 Edition, www.gane.ai/index/it.