Dependencies in a software project are a frequent source of security concerns. Identifying and updating outdated dependencies is crucial for maintaining secure and functional software. 

 is a fantastic tool for automating this process, and when paired with Cloudsmith, you get a robust solution for managing both public and private dependencies.

Here's how you can leverage Cloudsmith with Dependabot to streamline your dependency management.

Dependabot works by checking for newer versions of your dependencies and automatically creating pull requests to update them. By integrating Cloudsmith, you can ensure that Dependabot also considers your private packages and adheres to your organization's security and compliance policies.

Cloudsmith provides several key benefits when used with Dependabot, including:

 All dependencies, whether public or private, are fetched from a single, controlled source.

 You can enforce security and compliance policies on all dependencies, ensuring that only approved packages are used.

 By using a single source for dependencies, you avoid discrepancies and ensure that your builds are consistent across different environments.

 Cloudsmith helps you securely consume open-source packages by enforcing policies and filtering out packages that do not meet your security standards.

Cloudsmith upstreams allow you to proxy and cache dependencies from remote and public repositories (e.g., PyPI, Maven Central, Gradle, or NuGet) into your Cloudsmith repository. This setup provides several benefits:

 By caching packages, you mitigate risks associated with service disruptions on remote repositories.

 Cached packages mean faster builds and reduced latency.

 Centralized management of dependencies allows for control and adherence to security policies.

 setting with Dependabot, upstreams play a crucial role in ensuring that all dependencies are managed through Cloudsmith.

The replaces-base setting in Dependabot’s configuration allows you to control which registry Dependabot uses as the primary source for dependencies. When set to true, Dependabot will use the specified Cloudsmith URL instead of the default public repository for that package ecosystem. This means you should configure a corresponding Cloudsmith upstream to ensure Dependabot checks Cloudsmith first for dependencies.

Let's walk through the process of integrating Cloudsmith with Dependabot. I'm using a Python project as an example, but the steps are similar for other ecosystems.

Add Cloudsmith API Token to GitHub Secrets. First, you'll need to add your Cloudsmith API key and username to your GitHub repository secrets:

Go to Settings > Secrets and variables > Dependabot.

Enable Dependabot in GitHubEnsure Dependabot is enabled in your repository:

Create a dependabot.yml configuration file in the .github directory.

Configure the Dependabot Configuration File

Create and configure the dependabot.yml file to connect to your Cloudsmith repository:

For more detailed instructions, please refer to our 

By integrating Cloudsmith with Dependabot, you can automate the management of both public and private dependencies, ensuring that your dependencies are always up-to-date and secure.

Cloudsmith’s centralized management and enhanced security features make it an ideal solution for organizations looking to streamline their dependency management processes.

Start leveraging the power of Cloudsmith and Dependabot today to keep your dependencies up-to-date and your projects running smoothly.

Ciara Carey

Solutions Engineer

Fortify Dependency Management With Cloudsmith + Dependabot

Cloudsmith proudly introduces support for private Hex package repositories, marking a significant milestone in supply chain security and package management for Erlang and Elixir teams.

With Cloudsmith, you can manage, develop and distribute your Hex packages in your own private Hex registry using familiar tooling, ensuring seamless integration into your existing workflow.

Our fully managed platform provides global distribution for remote teams, with 410 points of presence around the world, ensuring elasticity to scale with your team's needs.

Enjoy peace of mind with built-in security scanning for malware and CVEs, and define how to handle low, medium, and critical issues.

Plus, our transparent pricing makes Cloudsmith affordable for teams of all sizes, and you'll receive quality Engineer led support, ensuring a smooth experience from start to finish.

Hex is a package manager for the BEAM ecosystem; any language that compiles to run on the BEAM VM, such as elixir and Erlang, can be used to build Hex packages.

Hex is an open-source project initiated in early 2014, and continues to evolve under the stewardship of Six Colors AB which was founded in 2018 by Hex's creator, Eric Meadows-Jönsson.

Since its inception, Hex has become indispensable for Erlang and Elixir developers, facilitating dependency management and third-party library integration with ease.

With Cloudsmith's launch of private Hex repositories, developers now have a secure and flexible solution for hosting and distributing Hex packages internally for development or externally for distribution.

Running your private Hex repository on Cloudsmith provides numerous advantages:

 Develop and securely share Hex packages internally and share them privately to other teams anywhere in the world.

 Seamlessly distribute and deploy your organization's Hex packages within CI/CD pipelines.

 Distribute Hex packages globally as commercial software, with granular control over access and distribution.

Mirror public Hex packages and insulate your organization from uncontrolled public upstream.

 Capture the precise state of dependencies at specific versions/releases for improved version control.

 Manage access to Hex packages efficiently with Cloudsmith's comprehensive access management features.

Getting started with Cloudsmith and Hex is straightforward:

and create a repository to host your Hex packages.

Publishing your Hex packages to Cloudsmith

Add Cloudsmith as a repository using the Mix client:

Create your Hex package following standard procedures for building and packaging your Erlang or Elixir project.

Ensure that your Hex package is properly configured and ready for publication. This includes updating the 

 file with the necessary metadata and dependencies. Simply update the 

 with your Cloudsmith repository's URL and authentication details like this:

For detailed setup instructions and integration guidance, refer to 

 or the contextual documentation within your Cloudsmith repository.

Cloudsmith's private Hex repositories provide a robust and flexible solution for managing Hex packages within your organization.

As the only cloud-native, global, and universal artifact management platform designed for secure software development and distribution, Cloudsmith provides the essential security, reliability, and control necessary to secure and streamline package management workflows.

We're extremely proud to be able to support the Erlang and Elixir ecosystems with this first (non-official) implementation of public and private Hex registries.

Start leveraging Cloudsmith today and experience the benefits of hosting your Hex packages in the world's first private Hex repository service.

Cloudsmith Blog

Fortify Dependency Management With Cloudsmith + Dependabot

World's First Private Hex Repository with Cloudsmith