Depfu

Depfu helps keep software dependencies up to date by sending pull requests with updates and related information. It connects to GitHub and GitLab repositories through their APIs, and users decide whether to merge each request. Supported ecosystems include Ruby Bundler, JavaScript npm, Yarn and pnpm, PHP Composer, and Elixir Hex. Update settings can be configured individually, grouped into recurring updates, or limited to security issues. Vulnerability updates take priority, with Depfu syncing against open-source databases and GitHub security alerts. The service keeps no more than seven dependency-update pull requests open at once. Depfu says it accesses repositories through the APIs without cloning them and encrypts traffic to and within its service using SSL/TLS. Web and self-hosted options are listed. Depfu Enterprise runs on customer infrastructure with GitHub Enterprise or self-hosted GitLab, keeping code inside the customer’s network; it requires a Linux machine or VM supporting Docker, at least two CPU cores, and 8 GB of RAM. The free plan covers public and personal account repositories. Paid plans start at $29 per month for five private repositories; higher listed plans cost $59 and $99 per month, and Enterprise Starter is $1200 per year.

Depfu automates dependency update proposals while leaving merge decisions with users. It offers a free option, paid plans from $29 per month, and a customer-hosted Enterprise deployment with stated infrastructure requirements.

Depfu suits developers or teams maintaining dependencies in supported GitHub or GitLab repositories. Its Enterprise deployment is for organizations that want the service running on customer infrastructure.

Depfu is a dependency update service for projects on GitHub or GitLab. It suits developers who want update proposals delivered for review, with options to group routine changes or prioritize security fixes. Its value depends on whether its supported ecosystems and private-repository limits fit your projects.

Overview

Depfu keeps software dependencies current by opening pull requests with proposed updates and related information. Users decide what to merge, so the service streamlines update work without taking the final change decision out of their hands.

It supports Ruby Bundler, JavaScript npm, Yarn and pnpm, PHP Composer, and Elixir Hex. GitHub and GitLab repositories connect through their APIs. Depfu says it does not clone repositories and encrypts traffic to and within its service with SSL/TLS. That approach may suit teams mindful of repository access, while the service still depends on an API connection to the code host.

Key features

Update choices and review limits

Teams can receive individual updates, recurring grouped updates, or security-only updates. This lets a team align proposals with its review habits, from assessing changes one by one to batching routine maintenance. Depfu keeps the number of open dependency update pull requests to seven or fewer. That cap can help contain review volume, but it may slow progress when a repository has many pending updates.

Security updates

Vulnerability updates jump ahead of routine proposals. Depfu syncs with open-source databases and GitHub security alerts, making security fixes a priority within the update queue. Users still control whether to merge each proposal.

Enterprise deployment

Depfu Enterprise runs on customer infrastructure with GitHub Enterprise or self-hosted GitLab, keeping code inside the customer’s network. It requires a Linux machine or VM that supports Docker, with at least two CPU cores and 8 GB of RAM. This option fits organizations that need an in-network deployment and can provide that infrastructure.

Pricing

Depfu has a free plan, a 21-day trial, and paid plans billed monthly or annually. All listed plans include unlimited dependency updates; the key tradeoffs are private-repository or developer limits and support.

• Open Source/Personal: free. It covers public repositories and personal account repositories, with unlimited dependency updates. This is the entry point for public or personal projects.
• Starter: $29 a month, billed monthly, for 5 private repos and unlimited dependency updates. It suits an individual or small team with a few private repositories; the five-repository cap is the main constraint.
• Team: $59 a month, billed monthly, for 25 private repos and unlimited dependency updates. It raises the private-repository allowance for a growing portfolio, without the Premium Support included in Business.
• Business: $99 a month, billed monthly, for 100 private repos, unlimited dependency updates, and Premium Support. It is the listed fit for larger private-repository portfolios that also want that support.
• Enterprise Starter: $1,200 a year, billed annually, for up to 10 developers, unlimited repos, and unlimited dependency updates. The annual term and developer cap make it a distinct fit for smaller organizations needing Enterprise deployment.
• Enterprise: custom pricing for more than 10 developers, with unlimited repos, unlimited dependency updates, and Premium Support.

The free plan is limited to public and personal account repositories. Private-repository access starts at $29 a month, and Enterprise Starter is an annual commitment. Depfu’s team also offers customer service; Premium Support is included with Business and Enterprise.

Platforms

Depfu is available on the web and as a self-hosted Enterprise deployment. The hosted service connects to GitHub and GitLab through their APIs; Enterprise supports GitHub Enterprise or self-hosted GitLab on customer infrastructure.

Who it's for

Depfu is a good fit for developers and teams using its supported ecosystems who want a steady stream of reviewable dependency proposals, adjustable update grouping, and security updates moved to the front of the queue. Public and personal projects can use the free plan, while teams with private repositories can choose a paid allowance that matches their portfolio. It is less compelling for teams with many simultaneous update proposals, since only seven can remain open, or for organizations whose code-hosting setup and infrastructure do not match its integrations and Enterprise requirements.

Pros and cons

• Pro: Individual, grouped, and security-only update modes let teams fit proposals to their review process.
• Pro: Security fixes jump the queue, with vulnerability signals from open-source databases and GitHub security alerts.
• Pro: The free plan includes unlimited updates for public and personal account repositories.
• Con: Only seven update pull requests can be open at once, which can limit throughput for a large backlog.
• Con: The free plan excludes private repositories, and the first listed private-repository plan costs $29 a month.
• Con: Enterprise deployment requires customer-managed Linux and Docker infrastructure with at least two CPU cores and 8 GB of RAM.

Alternatives

Choose ActiveState Platform if you need its broader platform coverage, which includes API, Linux, macOS, web, and Windows, or a free organization plan for public projects. Marshal is a self-hosted, free alternative with a CLI and GitHub Action plan. Consider Sonatype Nexus Repository for its repository-management focus, with a free Community Edition that includes full ecosystem support, CI/CD integration, and an external PostgreSQL database option. DepsHub offers an Open Source plan with unlimited public repositories and team members, unlimited security alerts, basic integrations, and basic chat support. Endor Labs has a free Developer plan for individual developers, with local scans via its AURI MCP server and no account required. FOSSA may suit teams that want a free plan capped at five projects and ten contributing developers, with scans covering five dependency levels. Kusari is another freemium option with a free plan. Choose Renovate if you want a free cloud or self-hosted option with job scheduling and API access.

For more options, browse Dependency Management Software.

Verdict

Depfu is best for developers and teams who want dependency updates prepared as pull requests, control over routine update grouping, and security fixes prioritized. Its free public and personal plan makes it accessible for smaller projects, while paid tiers add defined private-repository capacity. Look elsewhere if seven open proposals would bottleneck your update work, or if you need a deployment beyond its GitHub and GitLab integrations.