Condux vs Dependabot: bumps on a schedule, or fixes where you triage
Dependabot is free, built into GitHub, and very good at what it does. Condux reads the same advisories and puts them next to the runtime errors from that service, with the same review workflow as any other fix.
Condux is not trying to replace Dependabot, and on GitHub it reads exactly the advisories Dependabot has already computed. The difference is where the work happens. Dependabot opens bump pull requests on its own schedule in your repository. Condux shows those advisories in the same place you triage production errors, opens the bump only when someone asks for it, and counts it against the same fix allowance as an error fix. If you are happy with scheduled bumps, keep them.
Condux vs Dependabot, side by side
We only claim what ships, and we state their published facts. Nothing invented.
| Feature | Condux | Dependabot |
|---|---|---|
| What it does | Advisories beside your production errors, with a bump pull request on request | Scheduled dependency bump pull requests in the repository |
| Runtime errors | The core of the product; an advisory sits next to the exceptions from that service | Not an error monitor |
| Forges | GitHub today, with an OSV-backed scanner built for other forges | GitHub only |
| Cost | Included in your plan's monthly fix allowance | Free on GitHub |
| Review | Draft pull requests only, never merged automatically | Pull requests you review, with optional auto-merge |
When to choose Dependabot over Condux
Balanced beats biased. Here is where they are the better call.
- You are on GitHub, you want dependency bumps on a schedule, and you do not need them anywhere near your error monitoring. Dependabot is free and does that well.
- You want automatic merging of routine bumps. Condux never merges anything for you, by design.
Frequently asked questions
Does Condux replace Dependabot?
No, and on GitHub it reads the same advisories Dependabot produces. What it adds is context and control: the advisory appears where you triage production errors, and the bump opens when someone asks rather than on a schedule. Plenty of teams run both.
Does it work outside GitHub?
The advisory list is GitHub-backed today. A forge-neutral scanner built on the OSV database is in the product for repositories hosted elsewhere, and is what the surface will read from once a second forge is connected.