deppbot review
A focused Ruby dependency updater for GitHub teams that want scheduled pull requests.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
deppbot is a hosted dependency-update service for Ruby projects using Bundler, Gemfile, and Gemfile.lock. It runs scheduled bundle updates on subscribed repositories, creates branches and GitHub pull requests for Gemfile.lock changes, and can open security update pull requests when vulnerable Ruby gems are detected. It is aimed at small Ruby teams that want automated dependency maintenance without adopting a broad software composition analysis platform.
Its plan structure is straightforward. The Free plan covers all public repositories and includes daily bundle updates without a credit card. Solo covers one private repository, Team covers three, and Plus covers ten; each paid tier includes a 14-day free trial and daily bundle updates. The plans also show yearly billing options, and a two-month-free statement is presented alongside the billing choices. Update frequency can be set to 1 day, 3 days, 5 days, 1 week, or 2 weeks, giving teams control over how often dependency changes are proposed.
Platform fit is strongest for GitHub-based Ruby workflows. deppbot creates branches and pull requests on GitHub, while private RubyGems hosted on Bitbucket can be processed with collaborator access. During processing, the repository is cloned and the cloned source is deleted immediately after the bundle update run. The narrow scope is also its main boundary: teams working across multiple programming ecosystems, or those needing SBOM generation, reachability analysis, or broader pull-request scanning, should choose a more comprehensive SCA product. deppbot suits Ruby teams focused specifically on scheduled dependency updates and security fixes.
deppbot pros and cons
- Where it wins
- Scheduled Bundler updates with configurable frequencies
- Security pull requests for vulnerable Ruby gems
- Supports GitHub, Bitbucket, and RubyGems workflows
- Where it doesn't
- Ruby-only scope limits coverage across other ecosystems
- No SBOM or dependency reachability features
- No pull-request scanning beyond dependency update workflows
deppbot fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update