Depfu
Depfu helps keep software dependencies current by sending update pull requests to GitHub and GitLab repositories.
What Depfu is
Depfu helps keep software dependencies current by sending update pull requests to GitHub and GitLab repositories. Each request includes dependency changes and related information; users decide whether to merge it. It supports Ruby Bundler, npm, Yarn, pnpm, PHP Composer and Elixir Hex. Updates can be configured individually, grouped into recurring requests or limited to security issues. Security vulnerability updates take priority, with signals from open-source databases and GitHub security alerts. Depfu limits open dependency update pull requests to seven at a time. It says it accesses repositories through their APIs without cloning them and encrypts traffic with SSL/TLS. The service is available on the web and as a self-hosted deployment. Depfu Enterprise runs on customer infrastructure with GitHub Enterprise or self-hosted GitLab, keeping code within the customer’s network.
Good
- Supports Ruby, JavaScript, PHP and Elixir ecosystems
- Security updates take priority
- Configure individual, grouped or security-only updates
- Free plan covers public and personal repositories
Watch out
- No more than seven update pull requests can be open
- Enterprise requires Linux, Docker, two CPU cores and 8 GB RAM
Who it suits
Depfu suits developers and teams maintaining repositories that use its supported ecosystems. Its self-hosted Enterprise option may suit organizations that need code to remain within their network.
Verdict
Depfu automates dependency update requests while leaving merge decisions with repository users. Its ecosystem coverage and security-update workflow are key considerations, alongside the seven-request limit and plan requirements.
Plans and prices
From Depfu's own pricing page, checked 1 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Open Source/Personal | Free | public and personal account repos · Unlimited dependency updates |
| Starter | $29 a month | 5 private repos · Unlimited dependency updates · monthly |
| Team | $59 a month | 25 private repos · Unlimited dependency updates · monthly |
| Business | $99 a month | 100 private repos · Unlimited dependency updates · Premium Support · monthly |
| Enterprise Starter | $1,200 a year | Up to 10 developers · Unlimited repos · Unlimited dependency updates · annually |
| Enterprise | Priced on request | More than 10 developers · Unlimited repos · Unlimited dependency updates · Premium Support |
The facts
Each one read from Depfu's own pages, with the date it was checked.
What it does
- Encryption
- Depfu says all traffic to and inside its service is encrypted with SSL/TLS.checked 1 Oct 2026
- Enterprise deployment
- Depfu Enterprise runs on the customer’s infrastructure with GitHub Enterprise or self-hosted GitLab, and the customer’s code stays in its network.checked 1 Oct 2026
- Enterprise requirements
- Depfu Enterprise requires a Linux machine or VM supporting Docker with at least two CPU cores and 8 GB of RAM.checked 1 Oct 2026
- Pull-request limit
- Depfu never has more than seven dependency update pull requests open at the same time.checked 1 Oct 2026
- Purpose
- Depfu is an online tool that helps keep software dependencies up to date.checked 1 Oct 2026
- Repository integrations
- Depfu connects to GitHub and GitLab repositories through their APIs.checked 1 Oct 2026
- Security updates
- Security vulnerability updates jump the queue and Depfu syncs with open-source databases and GitHub security alerts.checked 1 Oct 2026
- Source-code handling
- Depfu says it never clones repositories and accesses them through the GitHub or GitLab API.checked 1 Oct 2026
- Support
- The maker says its bootstrapped two-person team provides customer service and offers Premium Support on the Business and Enterprise plans.checked 1 Oct 2026
- Supported ecosystems
- Depfu supports Ruby Bundler, JavaScript npm/Yarn/pnpm, PHP Composer, and Elixir Hex.checked 1 Oct 2026
- Update strategies
- Users can configure individual updates, recurring grouped updates, or security-only updates.checked 1 Oct 2026
- Update workflow
- Depfu sends pull requests containing dependency updates and related information while users control whether to merge them.checked 1 Oct 2026
The company
- Headquarters
- Hamburg, Germanychecked 28 Sep 2026
Alternatives to Depfu
- 1
Renovate
Free planOpen sourceWebAPISelf-hosted7.8From $250 a year - 2
GitHub CodeQL
Free planWebExtensionLinuxmacOS7.5From $30 a month - 3
Endor Labs
Free planWebAPIExtensionLinux7.4Free plan - 4
Snyk Open Source
Free planWebAPILinuxmacOS7.3From $25 a month - 5
ActiveState Platform
Free planWebAPILinuxmacOS7.2Free plan - 6
Socket
Free planWebAPIExtensionLinux7.2From $25 a month