It turns out that Dependabot supports updating Git submodules: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#package-ecosystem This could be used to keep these submodules up to date: https://github.com/heroku/buildpacks-php/blob/main/.gitmodules Currently they are behind latest, eg: https://github.com/heroku/buildpacks-php/tree/main/buildpacks/php/tests/fixtures/smoke -> `heroku-php-getting-started @ 752212a` vs https://github.com/heroku/php-getting-started/commits/main/ cc @dzuelke