How does Dependabot handle semantic versioning ranges when proposing updates?

Dependabot respects semantic versioning (semver: MAJOR.MINOR.PATCH) conventions when deciding what update to propose — understanding that a patch bump (bug fixes) carries lower risk than a minor bump (new backward-compatible features), which in turn carries lower risk than a major bump (potentially breaking changes), per the semver specification's own convention.

#  current: 2.3.1
#  patch update proposal: 2.3.2   (bug fixes only)
#  minor update proposal: 2.4.0   (new features, backward-compatible)
#  major update proposal: 3.0.0   (potentially breaking changes)

By default, Dependabot proposes updates across all three categories, but this behavior is configurable (discussed elsewhere) precisely because teams often want different risk tolerances for each — happy to auto-merge patch updates without much scrutiny, but wanting mandatory manual review (or even deferral) for major version bumps that could introduce breaking API changes.

Invest now in Acorns!!! 🚀
Join Acorns and get your $5 bonus!

Acorns is a micro-investing app that automatically invests your "spare change" from daily purchases into diversified, expert-built portfolios of ETFs. It is designed for beginners, allowing you to start investing with as little as $5. The service automates saving and investing. Disclosure: I may receive a referral bonus.

Invest now!!! Get Free equity stock (US, UK only)!

Use Robinhood app to invest in stocks. It is safe and secure. Use the Referral link to claim your free stock when you sign up!.

The Robinhood app makes it easy to trade stocks, crypto and more.

Webull! Receive free stock by signing up using the link: Webull signup.