Scandar and Dependabot
Both end at a pull request. Dependabot is the one GitHub already runs. Scandar is the one that reads your lockfile and waits for you to choose the packages.
Information verified on 25 October 2026; plans change, check their site. Dependabot cells were checked against GitHub’s documentation for Dependabot security updates.
| Scandar | Dependabot | |
|---|---|---|
| Where it runs | One Node process you host. Postgres stays on that machine. | On GitHub. Nothing to run yourself. |
| What it reads | The lockfile already in the repository. | Alerts cover the dependency graph. Security updates run for dependencies named in a manifest or lock file. |
| Advisories | OSV.dev. Duplicate IDs from GHSA and the ecosystem databases are merged. | GitHub may send an alert for a vulnerability disclosed by a GitHub security advisory. |
| The pull request | Opened from the app, for the packages you check. Major bumps start unchecked. | With security updates on, Dependabot opens a pull request to the minimum patched version. Version updates are a separate feature. |
| Rewriting the lockfile | npm, pnpm, and Yarn classic. Yarn Berry is scanned and not regenerated. | For npm, Dependabot can update an explicit dependency even when that changes a parent or removes a sub-dependency. For other ecosystems it does not update an indirect dependency when the parent must change too. |
| Other ecosystems | Python (not Pipfile.lock), Go, Rust, PHP, and Ruby can be regenerated when that tool is installed on the server. Otherwise the fix stays listed and no pull request is opened. | GitHub documents the supported ecosystems on a separate page. This note does not repeat a list it did not re-read. |
| Ignoring an advisory | A reason, a note, and an expiry from 30 days to forever. It comes back when that ends. | A dependabot.yml file can set schedules, pull request settings, and which dependencies to monitor. |
| Merging | Squash merge in the app. Refused on conflicts, failing checks, or branch protection. | You merge the pull request on GitHub. |
When Dependabot is the right tool
Dependabot is already on the repository. Alerts show up in the Security tab, and security update pull requests do not need a server, a GitHub App of your own, or npm on a machine you operate. Version updates are a separate schedule, committed as dependabot.yml.
If the goal is “GitHub opens the pull request and I review it,” Dependabot does that without another app in the middle.
What Scandar adds on top of a lockfile
Scandar only sees the repositories the GitHub App is installed on. It parses the lockfile in the tree, asks OSV.dev, and shows a fix plan before anything is pushed. Direct ranges move to ^fixed. Transitive packages are pinned with overrides, pnpm.overrides, or Yarn resolutions. The lockfile is regenerated in a temporary directory with package scripts disabled.
Python (except Pipfile.lock), Go, Rust, PHP, and Ruby can be regenerated when that ecosystem’s tool is installed on the server. If it is not, the fixed version stays listed and no pull request is opened for that lockfile.
What you still do yourself
Nothing lands on the default branch until you merge. Squash merge from the app is refused when the pull request conflicts, checks fail, or branch protection blocks it. An ignored advisory drops out of totals, fixes, notifications, and the Scandar check until the expiry you set.
The rest of the product is local to that process: a 90-day history, npm package health, CycloneDX and SPDX exports, a README badge, Slack or Discord webhooks, and a check named Scandar on pull requests in tracked repositories.