Buddy

Review

AI Code Review Inline findings anchored to the lines you changed Conversations @buddy answers, re-reviews, resolves and pauses Local Review Read the working tree before the PR exists Finishing Touches Tests, docstrings and autofix, as a stacked PR

Automate

Merge Gates A real check run, not a comment nobody reads CI Repair Classify a failing run and fix what is unambiguous Dependency Updates Eleven ecosystems, real changelogs, auto-merge

Platform

Workflow Security Supply-chain footguns in .github/workflows Your CI, Your Keys No hosted app, no diff leaving your pipeline
Nine jobs, one binary. All features →

By team

Open Source A reviewer a maintainer cannot hire Startups No spare reviewer, no time for updates Platform & Enterprise Standards as check runs, on your infrastructure Agencies Twenty client repositories, one config

By job

Monorepos Every manifest at every depth, no setting Security & Compliance Licences, advisories and supply-chain audits Migrating Bring the Renovate config you already wrote AI Coding Agents Close the loop before the PR exists
Find the shape of your problem. All use cases →
GuideCLIAIConfigAPIGitHub

buddy vs dependabot

Free is a strong opening bid

Dependabot's advantage is real: it is already in your repository, it costs nothing, and it takes one YAML file. Buddy is worth the swap when that one file has stopped being enough — noise, missing ecosystems, no grouping worth the name, and no reviewer anywhere in sight.

Migrate from Dependabot Dependency updates All comparisons
one PR instead of nine
$ buddy scan

             __
    (\,------'()'--o    grouped by policy
     (_    ___    /~"   not one PR per package
      (_)_)  (_)_)

  Types           @types/node, @types/react,
                  @types/react-dom, @types/bun
                  → 1 pull request

  ESLint          eslint, @typescript-eslint/*,
                  eslint-plugin-*
                  → 1 pull request

  go.mod          2 updates    → 1 pull request
  Cargo.toml      1 update     → 1 pull request

  9 packages, 4 pull requests,
  4 CI runs instead of 9.
🎨

Grouping that actually reduces noise

Group by pattern with a per-group strategy, so @types/* moves together on minor while eslint* stays on patch. One review, one merge, one CI run — instead of nine pull requests that each invalidate the other eight's lock file.

🌍

More ecosystems

npm, Bun, yarn, pnpm, Composer, Docker, GitHub Actions, pkgx, Launchpad, Zig, Python, Rust, Go and Ruby — including Bun's lock file, which Dependabot does not manage.

📊

A dashboard

One pinned issue holding every detected dependency and every open update, with checkboxes that force a rebase. Dependabot has no equivalent.

📜

Changelogs for the whole range

Every release between your version and the target, not just the newest. If the breaking change was in the middle of the range, it is in the pull request.

🔍

It reviews code too

Inline findings, in-thread commands, merge gates and CI repair. Dependabot is not trying to do this, which is fine — but you still need someone to.

🌐

Any git host

GitHub, GitLab and Bitbucket Cloud. Dependabot is GitHub-only by construction.

Side by side

BuddyDependabot
CostMIT + your model tokens + CI minutesFree
Setupbuddy setupOne YAML file
Ecosystems11, including Bun and pkgxMany, but no Bun lock file
GroupingPattern groups with per-group strategyBasic grouping
Dashboard✅ pinned issue—
ChangelogsEvery version in the rangeRelease notes for the target
Rebase on demand✅ checkbox, @buddy rebase@dependabot rebase
Auto-merge✅ with conditionsVia your own workflow
Security advisories✅ OSV✅ GitHub Advisory Database
AI code review✅—
Merge gates✅—
CI repair✅—
Git hostsGitHub, GitLab, Bitbucket CloudGitHub
Runs onYour CI minutesGitHub-hosted, free

Where Dependabot is the better choice

  • You want zero cost and zero thought. Dependabot needs no runner, no token, no model and no maintenance. For a small repository where dependency drift is the only problem, that is a very hard offer to beat, and you should probably just use it.
  • Security updates on a repository you barely touch. Dependabot's security alerts are enabled at the org level and require nothing from you per repository.
  • You cannot spend CI minutes. Buddy runs on your runner; Dependabot runs on GitHub's.

Where Buddy is different

  • The noise problem. The most common reason teams leave Dependabot is a pull request per package per week. Grouping fixes that at the policy level rather than by muting it.
  • Bun. If your repository has a bun.lock, Buddy maintains it.
  • Blocking policy. dependencyGate fails a check run on an advisory, a deprecated package, an EOL base image or a licence outside your allowlist — deterministically, with no model involved.
  • The other half. Once Buddy is installed for updates, the reviewer, the merge gates, the workflow audit and CI repair are already there.

Switching

bun add -g @buddysh/buddy
buddy setup    # detects and migrates .github/dependabot.yml

Schedules become presets, ignores carry over, and the migration report lists anything without an equivalent. Run both for a sprint if you like — Buddy uses its own branch prefix and labels. Details in migrating from Dependabot.

Dependency updates · Auto-merge · Buddy vs Renovate · All comparisons