Group user docs on code security into a new "product" (#18196)
This commit is contained in:
Felicity Chapman
@@ -5,8 +5,7 @@ redirect_from:
|
||||
- /articles/about-security-alerts-for-vulnerable-dependencies
|
||||
- /github/managing-security-vulnerabilities/about-security-alerts-for-vulnerable-dependencies
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '*'
|
||||
enterprise-server: '<=2.22'
|
||||
---
|
||||
|
||||
### About vulnerable dependencies
|
||||
|
||||
@@ -1,43 +0,0 @@
|
||||
---
|
||||
title: About Dependabot security updates
|
||||
intro: '{% data variables.product.prodname_dependabot %} can fix vulnerable dependencies for you by raising pull requests with security updates.'
|
||||
shortTitle: About Dependabot security updates
|
||||
redirect_from:
|
||||
- /github/managing-security-vulnerabilities/about-github-dependabot-security-updates
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
---
|
||||
|
||||
### About {% data variables.product.prodname_dependabot_security_updates %}
|
||||
|
||||
{% data variables.product.prodname_dependabot_security_updates %} make it easier for you to fix vulnerable dependencies in your repository. If you enable this feature, when a {% data variables.product.prodname_dependabot %} alert is raised for a vulnerable dependency in the dependency graph of your repository, {% data variables.product.prodname_dependabot %} automatically tries to fix it. For more information, see "[About alerts for vulnerable dependencies](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)" and "[Configuring {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/configuring-dependabot-security-updates)."
|
||||
|
||||
{% data variables.product.prodname_dependabot %} checks whether it's possible to upgrade the vulnerable dependency to a fixed version without disrupting the dependency graph for the repository. Then {% data variables.product.prodname_dependabot %} raises a pull request to update the dependency to the minimum version that includes the patch and links the pull request to the {% data variables.product.prodname_dependabot %} alert, or reports an error on the alert. For more information, see "[Troubleshooting {% data variables.product.prodname_dependabot %} errors](/github/managing-security-vulnerabilities/troubleshooting-dependabot-errors)."
|
||||
|
||||
{% note %}
|
||||
|
||||
**Note**
|
||||
|
||||
The {% data variables.product.prodname_dependabot_security_updates %} feature is available for repositories where you have enabled the dependency graph and {% data variables.product.prodname_dependabot_alerts %}. You will see a {% data variables.product.prodname_dependabot %} alert for every vulnerable dependency identified in your full dependency graph. However, security updates are triggered only for dependencies that are specified in a manifest or lock file. {% data variables.product.prodname_dependabot %} is unable to update an indirect or transitive dependency that is not explicitly defined. For more information, see "[About the dependency graph](/github/visualizing-repository-data-with-graphs/about-the-dependency-graph#dependencies-included)."
|
||||
|
||||
{% endnote %}
|
||||
|
||||
You can enable a related feature, {% data variables.product.prodname_dependabot_version_updates %}, so that {% data variables.product.prodname_dependabot %} raises pull requests to update the manifest to the latest version of the dependency, whenever it detects an outdated dependency. For more information, see "[About {% data variables.product.prodname_dependabot %} version updates](/github/administering-a-repository/about-dependabot-version-updates)."
|
||||
|
||||
{% data reusables.dependabot.pull-request-security-vs-version-updates %}
|
||||
|
||||
### About pull requests for security updates
|
||||
|
||||
Each pull request contains everything you need to quickly and safely review and merge a proposed fix into your project. This includes information about the vulnerability like release notes, changelog entries, and commit details. Details of which vulnerability a pull request resolves are hidden from anyone who does not have access to {% data variables.product.prodname_dependabot_alerts %} for the repository.
|
||||
|
||||
When you merge a pull request that contains a security update, the corresponding {% data variables.product.prodname_dependabot %} alert is marked as resolved for your repository. For more information about {% data variables.product.prodname_dependabot %} pull requests, see "[Managing pull requests for dependency updates](/github/administering-a-repository/managing-pull-requests-for-dependency-updates)."
|
||||
|
||||
{% data reusables.dependabot.automated-tests-note %}
|
||||
|
||||
### About compatibility scores
|
||||
|
||||
{% data variables.product.prodname_dependabot_security_updates %} may include compatibility scores to let you know whether updating a vulnerability could cause breaking changes to your project. These are calculated from CI tests in other public repositories where the same security update has been generated. An update's compatibility score is the percentage of CI runs that passed when updating between specific versions of the dependency.
|
||||
|
||||
### About notifications for {% data variables.product.prodname_dependabot %} security updates
|
||||
|
||||
You can filter your notifications on {% data variables.product.company_short %} to show {% data variables.product.prodname_dependabot %} security updates. For more information, see "[Managing notifications from your inbox](/github/managing-subscriptions-and-notifications-on-github/managing-notifications-from-your-inbox#dependabot-custom-filters)."
|
||||
@@ -1,46 +0,0 @@
|
||||
---
|
||||
title: About GitHub Security Advisories
|
||||
intro: 'You can use {% data variables.product.prodname_security_advisories %} to privately discuss, fix, and publish information about security vulnerabilities in your repository.'
|
||||
redirect_from:
|
||||
- /articles/about-maintainer-security-advisories
|
||||
- /github/managing-security-vulnerabilities/about-maintainer-security-advisories
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
---
|
||||
|
||||
{% data reusables.repositories.security-advisory-admin-permissions %}
|
||||
|
||||
{% data reusables.security-advisory.security-researcher-cannot-create-advisory %}
|
||||
|
||||
### About {% data variables.product.prodname_security_advisories %}
|
||||
|
||||
{% data variables.product.prodname_security_advisories %} allows repository maintainers to privately discuss and fix a security vulnerability in a project. After collaborating on a fix, repository maintainers can publish the security advisory to publicly disclose the security vulnerability to the project's community. By publishing security advisories, repository maintainers make it easier for their community to update package dependencies and research the impact of the security vulnerabilities.
|
||||
|
||||
With {% data variables.product.prodname_security_advisories %}, you can:
|
||||
|
||||
1. Create a draft security advisory, and use the draft to privately discuss the impact of the vulnerability on your project.
|
||||
2. Privately collaborate to fix the vulnerability in a temporary private fork.
|
||||
3. Publish the security advisory to alert your community of the vulnerability.
|
||||
|
||||
{% data reusables.repositories.security-advisories-republishing %}
|
||||
|
||||
To get started, see "[Creating a security advisory](/github/managing-security-vulnerabilities/creating-a-security-advisory)."
|
||||
|
||||
You can give credit to individuals who contributed to a security advisory. For more information, see "[Editing a security advisory](/github/managing-security-vulnerabilities/editing-a-security-advisory#about-credits-for-security-advisories)."
|
||||
|
||||
{% data reusables.repositories.security-guidelines %}
|
||||
|
||||
{% data reusables.repositories.github-security-lab %}
|
||||
|
||||
### CVE identification numbers
|
||||
|
||||
{% data variables.product.prodname_security_advisories %} builds upon the foundation of the Common Vulnerabilities and Exposures (CVE) list. {% data variables.product.prodname_dotcom %} is a CVE Numbering Authority (CNA) and is authorized to assign CVE identification numbers. For more information, see "[About CVE](https://cve.mitre.org/about/index.html)" and "[CVE Numbering Authorities](https://cve.mitre.org/cve/cna.html)" on the CVE website.
|
||||
|
||||
When you create a security advisory for a public repository on {% data variables.product.prodname_dotcom %}, you have the option of providing an existing CVE identification number for the security vulnerability. {% data reusables.repositories.request-security-advisory-cve-id %}
|
||||
|
||||
Once you've published the security advisory and {% data variables.product.prodname_dotcom %} has assigned a CVE identification number to the vulnerability, {% data variables.product.prodname_dotcom %} publishes the CVE to the MITRE database.
|
||||
For more information, see "[Publishing a security advisory](/github/managing-security-vulnerabilities/publishing-a-security-advisory#requesting-a-cve-identification-number)."
|
||||
|
||||
### {% data variables.product.prodname_dependabot_alerts %} for published security advisories
|
||||
|
||||
{% data reusables.repositories.github-reviews-security-advisories %}
|
||||
@@ -1,25 +0,0 @@
|
||||
---
|
||||
title: About managing vulnerable dependencies
|
||||
intro: '{% data variables.product.prodname_dotcom %} helps you to avoid using third-party software that contains known vulnerabilities.'
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
---
|
||||
|
||||
{% data variables.product.prodname_dotcom %} provides the following tools for removing and avoiding vulnerable dependencies.
|
||||
|
||||
#### Dependency graph
|
||||
The dependency graph is a summary of the manifest and lock files stored in a repository. It shows you the ecosystems and packages your codebase depends on (its dependencies) and the repositories and packages that depend on your project (its dependents). The information in the dependency graph is used by dependency review and {% data variables.product.prodname_dependabot %}.
|
||||
For more information, see "[About the dependency graph](/github/visualizing-repository-data-with-graphs/about-the-dependency-graph)."
|
||||
|
||||
#### Dependency review
|
||||
By checking the dependency reviews on pull requests you can avoid introducing vulnerabilities from dependencies into your codebase. If the pull requests adds a vulnerable dependency, or changes a dependency to a vulnerable version, this is highlighted in the dependency review. You can change the dependency to a patched version before merging the pull request. For more information, see "[Reviewing dependency changes in a pull request](/github/collaborating-with-issues-and-pull-requests/reviewing-dependency-changes-in-a-pull-request)."
|
||||
|
||||
#### {% data variables.product.prodname_dependabot_alerts %}
|
||||
{% data variables.product.prodname_dotcom %} can create {% data variables.product.prodname_dependabot_alerts %} when it detects vulnerable dependencies in your repository. The alert is displayed on the Security tab for the repository. The alert includes a link to the affected file in the project, and information about a fixed version. {% data variables.product.prodname_dotcom %} also notifies the maintainers of the repository, according to their notification preferences. For more information, see "[About alerts for vulnerable dependencies](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)."
|
||||
|
||||
#### {% data variables.product.prodname_dependabot_security_updates %}
|
||||
When {% data variables.product.prodname_dotcom %} generates a {% data variables.product.prodname_dependabot %} alert for a vulnerable dependency in your repository, {% data variables.product.prodname_dependabot %} can automatically try to fix it for you. {% data variables.product.prodname_dependabot_security_updates %} are automatically generated pull requests that update a vulnerable dependency to a fixed version. For more information, see "[About {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/about-dependabot-security-updates)."
|
||||
|
||||
|
||||
#### {% data variables.product.prodname_dependabot_version_updates %}
|
||||
Enabling {% data variables.product.prodname_dependabot_version_updates %} takes the effort out of maintaining your dependencies. With {% data variables.product.prodname_dependabot_version_updates %}, whenever {% data variables.product.prodname_dotcom %} identifies an outdated dependency, it raises a pull request to update the manifest to the latest version of the dependency. By contrast, {% data variables.product.prodname_dependabot_security_updates %} only raises pull requests to fix vulnerable dependencies. For more information, see "[About Dependabot version updates](/github/administering-a-repository/about-dependabot-version-updates)."
|
||||
@@ -1,36 +0,0 @@
|
||||
---
|
||||
title: Adding a collaborator to a security advisory
|
||||
intro: You can add other users or teams to collaborate on a security advisory with you.
|
||||
redirect_from:
|
||||
- /articles/adding-a-collaborator-to-a-maintainer-security-advisory
|
||||
- /github/managing-security-vulnerabilities/adding-a-collaborator-to-a-maintainer-security-advisory
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
---
|
||||
|
||||
People with admin permissions to a security advisory can add collaborators to the security advisory.
|
||||
|
||||
### Adding a collaborator to a security advisory
|
||||
|
||||
Collaborators have write permissions to the security advisory. For more information, see "[Permission levels for security advisories](/github/managing-security-vulnerabilities/permission-levels-for-security-advisories)."
|
||||
|
||||
{% note %}
|
||||
|
||||
{% data reusables.repositories.security-advisory-collaborators-public-repositories %} For more information about removing a collaborator on a security advisory, see "[Removing a collaborator from a security advisory](/github/managing-security-vulnerabilities/removing-a-collaborator-from-a-security-advisory)."
|
||||
|
||||
{% endnote %}
|
||||
|
||||
{% data reusables.repositories.navigate-to-repo %}
|
||||
{% data reusables.repositories.sidebar-security %}
|
||||
{% data reusables.repositories.sidebar-advisories %}
|
||||
4. In the "Security Advisories" list, click the security advisory you'd like to add a collaborator to.
|
||||
5. On the right side of the page, under "Collaborators", type the name of the user or team you'd like to add to the security advisory.
|
||||
|
||||
6. Click **Add**.
|
||||
|
||||
|
||||
### Further reading
|
||||
|
||||
- "[Permission levels for security advisories](/github/managing-security-vulnerabilities/permission-levels-for-security-advisories)"
|
||||
- "[Collaborating in a temporary private fork to resolve a security vulnerability](/github/managing-security-vulnerabilities/collaborating-in-a-temporary-private-fork-to-resolve-a-security-vulnerability)"
|
||||
- "[Removing a collaborator from a security advisory](/github/managing-security-vulnerabilities/removing-a-collaborator-from-a-security-advisory)"
|
||||
@@ -1,44 +0,0 @@
|
||||
---
|
||||
title: Adding a security policy to your repository
|
||||
intro: You can give instructions for how to responsibly report a security vulnerability in your project by adding a security policy to your repository.
|
||||
redirect_from:
|
||||
- /articles/adding-a-security-policy-to-your-repository
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
---
|
||||
|
||||
### About security policies
|
||||
|
||||
To give people instructions for responsibly reporting security vulnerabilities in your project, you can add a _SECURITY.md_ file to your repository's root, `docs`, or `.github` folder. When someone creates an issue in your repository, they will see a link to your project's security policy.
|
||||
|
||||
You can create a default security policy for your organization or user account. For more information, see "[Creating a default community health file](/github/building-a-strong-community/creating-a-default-community-health-file)."
|
||||
|
||||
{% tip %}
|
||||
|
||||
**Tip:** To help people find your security policy, you can link to your _SECURITY.md_ file from other places in your repository, such as your README file. For more information, see "[About READMEs](/articles/about-readmes)."
|
||||
|
||||
{% endtip %}
|
||||
|
||||
After someone reports a security vulnerability in your project, you can use {% data variables.product.prodname_security_advisories %} to disclose, fix, and publish information about the vulnerability. For more information, see "[About {% data variables.product.prodname_security_advisories %}](/github/managing-security-vulnerabilities/about-github-security-advisories)."
|
||||
|
||||
{% data reusables.repositories.github-security-lab %}
|
||||
|
||||
### Adding a security policy to your repository
|
||||
|
||||
{% data reusables.repositories.navigate-to-repo %}
|
||||
{% data reusables.repositories.sidebar-security %}
|
||||
3. In the left sidebar, click **Policy**.
|
||||
|
||||
4. Click **Start setup**.
|
||||
|
||||
5. In the new _SECURITY.md_ file, add information about supported versions of your project and how to report a vulnerability.
|
||||
{% data reusables.files.write_commit_message %}
|
||||
{% data reusables.files.choose-commit-email %}
|
||||
{% data reusables.files.choose_commit_branch %}
|
||||
{% data reusables.files.propose_file_change %}
|
||||
|
||||
### Further reading
|
||||
|
||||
- "[About securing your repository](/github/administering-a-repository/about-securing-your-repository)"
|
||||
- "[Setting up your project for healthy contributions](/github/building-a-strong-community/setting-up-your-project-for-healthy-contributions)"
|
||||
- [{% data variables.product.prodname_security %}]({% data variables.product.prodname_security_link %})
|
||||
@@ -1,83 +0,0 @@
|
||||
---
|
||||
title: Browsing security vulnerabilities in the GitHub Advisory Database
|
||||
intro: 'The {% data variables.product.prodname_advisory_database %} allows you to browse or search for vulnerabilities that affect open source projects on {% data variables.product.company_short %}.'
|
||||
shortTitle: Browsing the Advisory Database
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
---
|
||||
|
||||
### About security vulnerabilities
|
||||
|
||||
{% data reusables.repositories.a-vulnerability-is %}
|
||||
|
||||
{% data variables.product.product_name %} will send you {% data variables.product.prodname_dependabot_alerts %} if we detect that any of the vulnerabilities from the {% data variables.product.prodname_advisory_database %} affect the packages that your repository depends on. For more information, see "[About alerts for vulnerable dependencies](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)."
|
||||
|
||||
### About the {% data variables.product.prodname_advisory_database %}
|
||||
|
||||
The {% data variables.product.prodname_advisory_database %} contains a curated list of security vulnerabilities that have been mapped to packages tracked by the {% data variables.product.company_short %} dependency graph. {% data reusables.repositories.tracks-vulnerabilities %}
|
||||
|
||||
Each security advisory contains information about the vulnerability, including the description, severity, affected package, package ecosystem, affected versions and patched versions, impact, and optional information such as references, workarounds, and credits. In addition, advisories from the National Vulnerability Database list contain a link to the CVE record, where you can read more details about the vulnerability, its CVSS scores, and its qualitative severity level. For more information, see the "[National Vulnerability Database](https://nvd.nist.gov/)" from the National Institute of Standards and Technology.
|
||||
|
||||
The severity level is one of four possible levels defined in the "[Common Vulnerability Scoring System (CVSS), Section 5](https://www.first.org/cvss/specification-document)."
|
||||
- Low
|
||||
- Medium/Moderate
|
||||
- High
|
||||
- Critical
|
||||
|
||||
The {% data variables.product.prodname_advisory_database %} uses the CVSS levels described above. If {% data variables.product.company_short %} obtains a CVE, the {% data variables.product.prodname_advisory_database %} uses CVSS version 3.1. If the CVE is imported, the {% data variables.product.prodname_advisory_database %} supports both CVSS versions 3.0 and 3.1.
|
||||
|
||||
{% data reusables.repositories.github-security-lab %}
|
||||
|
||||
### Accessing an advisory in the {% data variables.product.prodname_advisory_database %}
|
||||
|
||||
1. Navigate to https://github.com/advisories.
|
||||
2. Optionally, to filter the list, use any of the drop-down menus.
|
||||
|
||||
3. Click on any advisory to view details.
|
||||
|
||||
{% note %}
|
||||
|
||||
The database is also accessible using the GraphQL API. For more information, see the "[`security_advisory` webhook event](/webhooks/event-payloads/#security_advisory)."
|
||||
|
||||
{% endnote %}
|
||||
|
||||
### Searching the {% data variables.product.prodname_advisory_database %}
|
||||
|
||||
You can search the database, and use qualifiers to narrow your search. For example, you can search for advisories created on a certain date, in a specific ecosystem, or in a particular library.
|
||||
|
||||
{% data reusables.time_date.date_format %} {% data reusables.time_date.time_format %}
|
||||
|
||||
{% data reusables.search.date_gt_lt %}
|
||||
|
||||
| Qualifier | Example |
|
||||
| ------------- | ------------- |
|
||||
| `GHSA-ID`| [**GHSA-49wp-qq6x-g2rf**](https://github.com/advisories?query=GHSA-49wp-qq6x-g2rf) will show the advisory with this {% data variables.product.prodname_advisory_database %} ID. |
|
||||
| `CVE-ID`| [**CVE-2020-28482**](https://github.com/advisories?query=CVE-2020-28482) will show the advisory with this CVE ID number. |
|
||||
| `ecosystem:ECOSYSTEM`| [**ecosystem:npm**](https://github.com/advisories?utf8=%E2%9C%93&query=ecosystem%3Anpm) will show only advisories affecting NPM packages. |
|
||||
| `severity:LEVEL`| [**severity:high**](https://github.com/advisories?utf8=%E2%9C%93&query=severity%3Ahigh) will show only advisories with a high severity level. |
|
||||
| `affects:LIBRARY`| [**affects:lodash**](https://github.com/advisories?utf8=%E2%9C%93&query=affects%3Alodash) will show only advisories affecting the lodash library. |
|
||||
| `cwe:ID`| [**cwe:352**](https://github.com/advisories?query=cwe%3A352) will show only advisories with this CWE number. |
|
||||
| `credit:USERNAME`| [**credit:octocat**](https://github.com/advisories?query=credit%3Aoctocat) will show only advisories credited to the "octocat" user account. |
|
||||
| `sort:created-asc`| [**sort:created-asc**](https://github.com/advisories?utf8=%E2%9C%93&query=sort%3Acreated-asc) will sort by the oldest advisories first. |
|
||||
| `sort:created-desc`| [**sort:created-desc**](https://github.com/advisories?utf8=%E2%9C%93&query=sort%3Acreated-desc) will sort by the newest advisories first. |
|
||||
| `sort:updated-asc`| [**sort:updated-asc**](https://github.com/advisories?utf8=%E2%9C%93&query=sort%3Aupdated-asc) will sort by the least recently updated first. |
|
||||
| `sort:updated-desc`| [**sort:updated-desc**](https://github.com/advisories?utf8=%E2%9C%93&query=sort%3Aupdated-desc) will sort by the most recently updated first. |
|
||||
| `is:withdrawn`| [**is:withdrawn**](https://github.com/advisories?utf8=%E2%9C%93&query=is%3Awithdrawn) will show only advisories that have been withdrawn. |
|
||||
| `created:YYYY-MM-DD`| [**created:2021-01-13**](https://github.com/advisories?utf8=%E2%9C%93&query=created%3A2021-01-13) will show only advisories created on this date. |
|
||||
| `updated:YYYY-MM-DD`| [**updated:2021-01-13**](https://github.com/advisories?utf8=%E2%9C%93&query=updated%3A2021-01-13) will show only advisories updated on this date. |
|
||||
|
||||
### Viewing your vulnerable repositories
|
||||
|
||||
For any vulnerability in the {% data variables.product.prodname_advisory_database %}, you can see which of your repositories have a {% data variables.product.prodname_dependabot %} alert for that vulnerability. To see a vulnerable repository, you must have access to {% data variables.product.prodname_dependabot_alerts %} for that repository. For more information, see "[About alerts for vulnerable dependencies](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies#access-to-dependabot-alerts)."
|
||||
|
||||
1. Navigate to https://github.com/advisories.
|
||||
2. Click an advisory.
|
||||
3. At the top of the advisory page, click **Dependabot alerts**.
|
||||
|
||||
4. Optionally, to filter the list, use the search bar or the drop-down menus. The "Organization" drop-down menu allows you to filter the {% data variables.product.prodname_dependabot_alerts %} per owner (organization or user).
|
||||
|
||||
5. For more details about the vulnerability, and for advice on how to fix the vulnerable repository, click the repository name.
|
||||
|
||||
### Further reading
|
||||
|
||||
- MITRE's [definition of "vulnerability"](https://cve.mitre.org/about/terminology.html#vulnerability)
|
||||
@@ -1,83 +0,0 @@
|
||||
---
|
||||
title: Collaborating in a temporary private fork to resolve a security vulnerability
|
||||
intro: You can create a temporary private fork to privately collaborate on fixing a security vulnerability in your repository.
|
||||
redirect_from:
|
||||
- /articles/collaborating-in-a-temporary-private-fork-to-resolve-a-security-vulnerability
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
---
|
||||
|
||||
### Prerequisites
|
||||
|
||||
Before you can collaborate in a temporary private fork, you must create a draft security advisory. For more information, see "[Creating a security advisory](/github/managing-security-vulnerabilities/creating-a-security-advisory)."
|
||||
|
||||
### Creating a temporary private fork
|
||||
|
||||
Anyone with admin permissions to a security advisory can create a temporary private fork.
|
||||
|
||||
To keep information about vulnerabilities secure, integrations, including CI, cannot access temporary private forks.
|
||||
|
||||
{% data reusables.repositories.navigate-to-repo %}
|
||||
{% data reusables.repositories.sidebar-security %}
|
||||
{% data reusables.repositories.sidebar-advisories %}
|
||||
4. In the "Security Advisories" list, click the security advisory you'd like to create a temporary private fork in.
|
||||
|
||||
5. Click **New temporary private fork**.
|
||||
|
||||
|
||||
### Adding collaborators to a temporary private fork
|
||||
|
||||
Anyone with admin permissions to a security advisory can add additional collaborators to the security advisory, and collaborators on the security advisory can access the temporary private fork. For more information, see "[Adding a collaborator to a security advisory](/github/managing-security-vulnerabilities/adding-a-collaborator-to-a-security-advisory)."
|
||||
|
||||
### Adding changes to a temporary private fork
|
||||
|
||||
Anyone with write permissions to a security advisory can add changes to a temporary private fork.
|
||||
|
||||
{% data reusables.repositories.navigate-to-repo %}
|
||||
{% data reusables.repositories.sidebar-security %}
|
||||
{% data reusables.repositories.sidebar-advisories %}
|
||||
4. In the "Security Advisories" list, click the security advisory you'd like to add changes to.
|
||||
|
||||
5. Add your changes on {% data variables.product.product_name %} or locally:
|
||||
- To add changes on {% data variables.product.product_name %}, under "Add changes to this advisory", click **the temporary private fork**. Then, create a new branch and edit files. For more information, see "[Creating and deleting branches within your repository](/articles/creating-and-deleting-branches-within-your-repository)" and "[Editing files in your repository](/articles/editing-files-in-your-repository)."
|
||||
- To add changes locally, follow the instructions under "Clone and create a new branch" and "Make your changes, then push."
|
||||
|
||||
|
||||
### Creating a pull request from a temporary private fork
|
||||
|
||||
Anyone with write permissions to a security advisory can create a pull request from a temporary private fork.
|
||||
|
||||
{% data reusables.repositories.navigate-to-repo %}
|
||||
{% data reusables.repositories.sidebar-security %}
|
||||
{% data reusables.repositories.sidebar-advisories %}
|
||||
4. In the "Security Advisories" list, click the security advisory you'd like to create a pull request in.
|
||||
|
||||
5. To the right of your branch name, click **Compare & pull request**.
|
||||
|
||||
{% data reusables.repositories.pr-title-description %}
|
||||
{% data reusables.repositories.create-pull-request %}
|
||||
|
||||
{% data reusables.repositories.merge-all-pulls-together %} For more information, see "[Merging changes in a security advisory](#merging-changes-in-a-security-advisory)."
|
||||
|
||||
### Merging changes in a security advisory
|
||||
|
||||
Anyone with admin permissions to a security advisory can merge changes in a security advisory.
|
||||
|
||||
{% data reusables.repositories.merge-all-pulls-together %}
|
||||
|
||||
Before you can merge changes in a security advisory, every open pull request in the temporary private fork must be mergeable. There can be no merge conflicts, and branch protection requirements must be satisfied. To keep information about vulnerabilities secure, status checks do not run on pull requests in temporary private forks. For more information, see "[About protected branches](/articles/about-protected-branches)."
|
||||
|
||||
{% data reusables.repositories.navigate-to-repo %}
|
||||
{% data reusables.repositories.sidebar-security %}
|
||||
{% data reusables.repositories.sidebar-advisories %}
|
||||
4. In the "Security Advisories" list, click the security advisory with changes you'd like to merge.
|
||||
|
||||
5. To merge all open pull requests in the temporary private fork, click **Merge pull requests**.
|
||||
|
||||
|
||||
After you merge changes in a security advisory, you can publish the security advisory to alert your community about the security vulnerability in previous versions of your project. For more information, see "[Publishing a security advisory](/github/managing-security-vulnerabilities/publishing-a-security-advisory)."
|
||||
|
||||
### Further reading
|
||||
|
||||
- "[Permission levels for security advisories](/github/managing-security-vulnerabilities/permission-levels-for-security-advisories)"
|
||||
- "[Publishing a security advisory](/github/managing-security-vulnerabilities/publishing-a-security-advisory)"
|
||||
@@ -1,63 +0,0 @@
|
||||
---
|
||||
title: Configuring Dependabot security updates
|
||||
intro: 'You can use {% data variables.product.prodname_dependabot_security_updates %} or manual pull requests to easily update vulnerable dependencies.'
|
||||
shortTitle: Configuring Dependabot security updates
|
||||
redirect_from:
|
||||
- /articles/configuring-automated-security-fixes
|
||||
- /github/managing-security-vulnerabilities/configuring-automated-security-fixes
|
||||
- /github/managing-security-vulnerabilities/configuring-automated-security-updates
|
||||
- /github/managing-security-vulnerabilities/configuring-github-dependabot-security-updates
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
---
|
||||
|
||||
### About configuring {% data variables.product.prodname_dependabot_security_updates %}
|
||||
|
||||
You can enable {% data variables.product.prodname_dependabot_security_updates %} for any repository that uses {% data variables.product.prodname_dependabot_alerts %} and the dependency graph. For more information, see "[About {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/about-dependabot-security-updates)."
|
||||
|
||||
You can disable {% data variables.product.prodname_dependabot_security_updates %} for an individual repository or for all repositories owned by your user account or organization. For more information, see "[Managing {% data variables.product.prodname_dependabot_security_updates %} for your repositories](#managing-dependabot-security-updates-for-your-repositories)" below.
|
||||
|
||||
{% data reusables.dependabot.dependabot-tos %}
|
||||
|
||||
### Supported repositories
|
||||
|
||||
{% data variables.product.prodname_dotcom %} automatically enables {% data variables.product.prodname_dependabot_security_updates %} for every repository that meets these prerequisites.
|
||||
|
||||
{% note %}
|
||||
|
||||
**Note**: You can manually enable {% data variables.product.prodname_dependabot_security_updates %}, even if the repository doesn't meet some of the prerequisites below. For example, you can enable {% data variables.product.prodname_dependabot_security_updates %} on a fork, or for a package manager that isn't directly supported by following the instructions in "[Managing {% data variables.product.prodname_dependabot_security_updates %} for your repositories](#managing-dependabot-security-updates-for-your-repositories)."
|
||||
|
||||
{% endnote %}
|
||||
|
||||
| Automatic enablement prerequisite | More information |
|
||||
| ----------------- | ----------------------- |
|
||||
| Repository is not a fork | "[About forks](/github/collaborating-with-issues-and-pull-requests/about-forks)" |
|
||||
| Repository is not archived | "[Archiving repositories](/github/creating-cloning-and-archiving-repositories/archiving-repositories)" |
|
||||
| Repository is public, or repository is private and you have enabled read-only analysis by {% data variables.product.prodname_dotcom %}, dependency graph, and vulnerability alerts in the repository's settings | "[Managing data use settings for your private repository](/github/understanding-how-github-uses-and-protects-your-data/managing-data-use-settings-for-your-private-repository)." |
|
||||
| Repository contains dependency manifest file from a package ecosystem that {% data variables.product.prodname_dotcom %} supports | "[Supported package ecosystems](/github/visualizing-repository-data-with-graphs/about-the-dependency-graph#supported-package-ecosystems)" |
|
||||
| {% data variables.product.prodname_dependabot_security_updates %} are not disabled for the repository | "[Managing {% data variables.product.prodname_dependabot_security_updates %} for your repository](#managing-dependabot-security-updates-for-your-repositories)" |
|
||||
| Repository is not already using an integration for dependency management | "[About integrations](/github/customizing-your-github-workflow/about-integrations)" |
|
||||
|
||||
If security updates are not enabled for your repository and you don't know why, first try enabling them using the instructions given in the procedural sections below. If security updates are still not working, you can [contact support](https://support.github.com/contact).
|
||||
|
||||
### Managing {% data variables.product.prodname_dependabot_security_updates %} for your repositories
|
||||
|
||||
You can enable or disable {% data variables.product.prodname_dependabot_security_updates %} for an individual repository (see below).
|
||||
|
||||
You can also enable or disable {% data variables.product.prodname_dependabot_security_updates %} for all repositories owned by your user account or organization. For more information, see "[Managing security and analysis settings for your user account](/github/setting-up-and-managing-your-github-user-account/managing-security-and-analysis-settings-for-your-user-account)" or "[Managing security and analysis settings for your organization](/github/setting-up-and-managing-organizations-and-teams/managing-security-and-analysis-settings-for-your-organization)."
|
||||
|
||||
{% data variables.product.prodname_dependabot_security_updates %} require specific repository settings. For more information, see "[Supported repositories](#supported-repositories)."
|
||||
|
||||
#### Enabling or disabling {% data variables.product.prodname_dependabot_security_updates %} for an individual repository
|
||||
|
||||
{% data reusables.repositories.navigate-to-repo %}
|
||||
{% data reusables.repositories.sidebar-settings %}
|
||||
{% data reusables.repositories.navigate-to-security-and-analysis %}
|
||||
1. Under "Configure security and analysis features", to the right of "{% data variables.product.prodname_dependabot %} security updates", click **Enable** or **Disable**.
|
||||
|
||||
|
||||
### Further reading
|
||||
|
||||
- "[About alerts for vulnerable dependencies](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)"
|
||||
- "[Managing data use settings for your private repository](/github/understanding-how-github-uses-and-protects-your-data/managing-data-use-settings-for-your-private-repository)"
|
||||
- "[Supported package ecosystems](/github/visualizing-repository-data-with-graphs/about-the-dependency-graph#supported-package-ecosystems)"
|
||||
@@ -3,8 +3,7 @@ title: Configuring notifications for vulnerable dependencies
|
||||
shortTitle: Configuring notifications
|
||||
intro: 'Optimize how you receive notifications about {% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.21" %}{% data variables.product.prodname_dependabot %}{% else %}security{% endif %} alerts.'
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=2.21'
|
||||
enterprise-server: '<=2.22'
|
||||
---
|
||||
|
||||
### About notifications for vulnerable dependencies
|
||||
|
||||
@@ -1,36 +0,0 @@
|
||||
---
|
||||
title: Creating a security advisory
|
||||
intro: You can create a draft security advisory to privately discuss and fix a security vulnerability in your open source project.
|
||||
redirect_from:
|
||||
- /articles/creating-a-maintainer-security-advisory
|
||||
- /github/managing-security-vulnerabilities/creating-a-maintainer-security-advisory
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
---
|
||||
|
||||
Anyone with admin permissions to a repository can create a security advisory.
|
||||
|
||||
{% data reusables.security-advisory.security-researcher-cannot-create-advisory %}
|
||||
|
||||
### Creating a security advisory
|
||||
|
||||
{% data reusables.repositories.navigate-to-repo %}
|
||||
{% data reusables.repositories.sidebar-security %}
|
||||
{% data reusables.repositories.sidebar-advisories %}
|
||||
4. Click **New draft security advisory**.
|
||||
|
||||
5. Type a title for your security advisory.
|
||||
{% data reusables.repositories.security-advisory-edit-details %}
|
||||
{% data reusables.repositories.security-advisory-edit-severity %}
|
||||
{% data reusables.repositories.security-advisory-edit-cwe-cve %}
|
||||
{% data reusables.repositories.security-advisory-edit-description %}
|
||||
11. Click **Create draft security advisory**.
|
||||
|
||||
|
||||
### Next steps
|
||||
|
||||
- Comment on the draft security advisory to discuss the vulnerability with your team.
|
||||
- Add collaborators to the security advisory. For more information, see "[Adding a collaborator to a security advisory](/github/managing-security-vulnerabilities/adding-a-collaborator-to-a-maintainer-security-advisory)."
|
||||
- Privately collaborate to fix the vulnerability in a temporary private fork. For more information, see "[Collaborating in a temporary private fork to resolve a security vulnerability](/github/managing-security-vulnerabilities/collaborating-in-a-temporary-private-fork-to-resolve-a-security-vulnerability)."
|
||||
- Add individuals who should receive credit for contributing to the security advisory. For more information, see "[Editing a security advisory](/github/managing-security-vulnerabilities/editing-a-security-advisory#about-credits-for-security-advisories)."
|
||||
- Publish the security advisory to notify your community of the security vulnerability. For more information, see "[Publishing a security advisory](/github/managing-security-vulnerabilities/publishing-a-security-advisory)."
|
||||
@@ -1,36 +0,0 @@
|
||||
---
|
||||
title: Editing a security advisory
|
||||
intro: You can edit the metadata and description for a security advisory if you need to update details or correct errors.
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
---
|
||||
|
||||
People with admin permissions to a security advisory can edit the security advisory.
|
||||
|
||||
### About credits for security advisories
|
||||
|
||||
You can credit people who helped discover, report, or fix a security vulnerability. If you credit someone, they can choose to accept or decline credit.
|
||||
|
||||
If someone accepts credit, the person's username appears in the "Credits" section of the security advisory. Anyone with read access to the repository can see the advisory and the people who accepted credit for it.
|
||||
|
||||
### Editing a security advisory
|
||||
|
||||
{% data reusables.repositories.navigate-to-repo %}
|
||||
{% data reusables.repositories.sidebar-security %}
|
||||
{% data reusables.repositories.sidebar-advisories %}
|
||||
4. In the "Security Advisories" list, click the security advisory you'd like to edit.
|
||||
5. In the upper-right corner of the details for the security advisory, click {% octicon "pencil" aria-label="The edit icon" %}.
|
||||
|
||||
{% data reusables.repositories.security-advisory-edit-details %}
|
||||
{% data reusables.repositories.security-advisory-edit-severity %}
|
||||
{% data reusables.repositories.security-advisory-edit-cwe-cve %}
|
||||
{% data reusables.repositories.security-advisory-edit-description %}
|
||||
11. Optionally, edit the "Credits" for the security advisory.
|
||||
|
||||
12. Click **Update security advisory**.
|
||||
|
||||
13. The people listed in the "Credits" section will receive an email or web notification inviting them to accept credit. If a person accepts, their username will be publicly visible once the security advisory is published.
|
||||
|
||||
### Further reading
|
||||
|
||||
- "[Withdrawing a security advisory](/github/managing-security-vulnerabilities/withdrawing-a-security-advisory)"
|
||||
@@ -3,30 +3,11 @@ title: Managing security vulnerabilities
|
||||
redirect_from:
|
||||
- /categories/managing-security-vulnerabilities
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '*'
|
||||
enterprise-server: '<=2.22'
|
||||
---
|
||||
|
||||
|
||||
### Table of Contents
|
||||
{% topic_link_in_list /managing-security-vulnerabilities-in-your-project %}
|
||||
{% link_in_list /adding-a-security-policy-to-your-repository %}
|
||||
{% link_in_list /about-github-security-advisories %}
|
||||
{% link_in_list /permission-levels-for-security-advisories %}
|
||||
{% link_in_list /creating-a-security-advisory %}
|
||||
{% link_in_list /adding-a-collaborator-to-a-security-advisory %}
|
||||
{% link_in_list /removing-a-collaborator-from-a-security-advisory %}
|
||||
{% link_in_list /collaborating-in-a-temporary-private-fork-to-resolve-a-security-vulnerability %}
|
||||
{% link_in_list /publishing-a-security-advisory %}
|
||||
{% link_in_list /editing-a-security-advisory %}
|
||||
{% link_in_list /withdrawing-a-security-advisory %}
|
||||
{% topic_link_in_list /managing-vulnerabilities-in-your-projects-dependencies %}
|
||||
{% link_in_list /about-managing-vulnerable-dependencies %}
|
||||
{% link_in_list /browsing-security-vulnerabilities-in-the-github-advisory-database %}
|
||||
{% link_in_list /about-alerts-for-vulnerable-dependencies %}
|
||||
{% link_in_list /configuring-notifications-for-vulnerable-dependencies %}
|
||||
{% link_in_list /about-dependabot-security-updates %}
|
||||
{% link_in_list /configuring-dependabot-security-updates %}
|
||||
{% link_in_list /viewing-and-updating-vulnerable-dependencies-in-your-repository %}
|
||||
{% link_in_list /troubleshooting-the-detection-of-vulnerable-dependencies %}
|
||||
{% link_in_list /troubleshooting-dependabot-errors %}
|
||||
|
||||
@@ -1,10 +0,0 @@
|
||||
---
|
||||
title: Managing security vulnerabilities in your project
|
||||
intro: 'You can discover, discuss, fix, and disclose security vulnerabilities in your repositories.'
|
||||
mapTopic: true
|
||||
redirect_from:
|
||||
- /articles/managing-security-vulnerabilities-in-your-project
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
---
|
||||
|
||||
@@ -8,7 +8,6 @@ redirect_from:
|
||||
- /articles/managing-security-vulnerabilities-in-your-projects-dependencies/
|
||||
- /articles/managing-vulnerabilities-in-your-projects-dependencies
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '*'
|
||||
enterprise-server: '<=2.22'
|
||||
---
|
||||
|
||||
|
||||
@@ -1,34 +0,0 @@
|
||||
---
|
||||
title: Permission levels for security advisories
|
||||
intro: The actions you can take in a security advisory depend on whether you have admin or write permissions to the security advisory.
|
||||
redirect_from:
|
||||
- /articles/permission-levels-for-maintainer-security-advisories
|
||||
- /github/managing-security-vulnerabilities/permission-levels-for-maintainer-security-advisories
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
---
|
||||
|
||||
### Permissions overview
|
||||
|
||||
{% data reusables.repositories.security-advisory-admin-permissions %} For more information about adding a collaborator to a security advisory, see "[Adding a collaborator to a security advisory](/github/managing-security-vulnerabilities/adding-a-collaborator-to-a-security-advisory)."
|
||||
|
||||
Action | Write permissions | Admin permissions |
|
||||
------ | ----------------- | ----------------- |
|
||||
See a draft security advisory | X | X |
|
||||
Add collaborators to the security advisory (see "[Adding a collaborator to a security advisory](/github/managing-security-vulnerabilities/adding-a-collaborator-to-a-security-advisory)") | | X |
|
||||
Edit and delete any comments in the security advisory | X | X |
|
||||
Create a temporary private fork in the security advisory (see "[Collaborating in a temporary private fork to resolve a security vulnerability](/articles/collaborating-in-a-temporary-private-fork-to-resolve-a-security-vulnerability)") | | X |
|
||||
Add changes to a temporary private fork in the security advisory (see "[Collaborating in a temporary private fork to resolve a security vulnerability](/articles/collaborating-in-a-temporary-private-fork-to-resolve-a-security-vulnerability)") | X | X |
|
||||
Create pull requests in a temporary private fork (see "[Collaborating in a temporary private fork to resolve a security vulnerability](/github/managing-security-vulnerabilities/collaborating-in-a-temporary-private-fork-to-resolve-a-security-vulnerability)") | X | X |
|
||||
Merge changes in the security advisory (see "[Collaborating in a temporary private fork to resolve a security vulnerability](/articles/collaborating-in-a-temporary-private-fork-to-resolve-a-security-vulnerability)") | | X |
|
||||
Add and edit metadata in the security advisory (see "[Publishing a security advisory](/github/managing-security-vulnerabilities/publishing-a-security-advisory)") | X | X |
|
||||
Add and remove credits for a security advisory (see "[Editing a security advisory](/github/managing-security-vulnerabilities/editing-a-security-advisory#about-credits-for-security-advisories)") | X | X |
|
||||
Close the draft security advisory | | X |
|
||||
Publish the security advisory (see "[Publishing a security advisory](/github/managing-security-vulnerabilities/publishing-a-security-advisory)") | | X |
|
||||
|
||||
### Further reading
|
||||
|
||||
- "[Adding a collaborator to a security advisory](/github/managing-security-vulnerabilities/adding-a-collaborator-to-a-security-advisory)"
|
||||
- "[Collaborating in a temporary private fork to resolve a security vulnerability](/github/managing-security-vulnerabilities/collaborating-in-a-temporary-private-fork-to-resolve-a-security-vulnerability)"
|
||||
- "[Removing a collaborator from a security advisory](/github/managing-security-vulnerabilities/removing-a-collaborator-from-a-security-advisory)"
|
||||
- "[Withdrawing a security advisory](/github/managing-security-vulnerabilities/withdrawing-a-security-advisory)"
|
||||
@@ -1,88 +0,0 @@
|
||||
---
|
||||
title: Publishing a security advisory
|
||||
intro: You can publish a security advisory to alert your community about a security vulnerability in your project.
|
||||
redirect_from:
|
||||
- /articles/publishing-a-maintainer-security-advisory
|
||||
- /github/managing-security-vulnerabilities/publishing-a-maintainer-security-advisory
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
---
|
||||
|
||||
Anyone with admin permissions to a security advisory can publish the security advisory.
|
||||
|
||||
### Prerequisites
|
||||
|
||||
Before you can publish a security advisory or request a CVE identification number, you must create a draft security advisory and provide information about the versions of your project affected by the security vulnerability. For more information, see "[Creating a security advisory](/github/managing-security-vulnerabilities/creating-a-security-advisory)."
|
||||
|
||||
If you've created a security advisory but haven't yet provided details about the versions of your project that the security vulnerability affects, you can edit the security advisory. For more information, see "[Editing a security advisory](/github/managing-security-vulnerabilities/editing-a-security-advisory)."
|
||||
|
||||
### About publishing a security advisory
|
||||
|
||||
When you publish a security advisory, you notify your community about the security vulnerability that the security advisory addresses. Publishing a security advisory makes it easier for your community to update package dependencies and research the impact of the security vulnerability.
|
||||
|
||||
{% data reusables.repositories.security-advisories-republishing %}
|
||||
|
||||
Before you publish a security advisory, you can privately collaborate to fix the vulnerability in a temporary private fork. For more information, see "[Collaborating in a temporary private fork to resolve a security vulnerability](/articles/collaborating-in-a-temporary-private-fork-to-resolve-a-security-vulnerability)."
|
||||
|
||||
{% warning %}
|
||||
|
||||
**Warning**: Whenever possible, you should always add a fix version to a security advisory prior to publishing the advisory. If you don't, the advisory will be published without a fixed version, and {% data variables.product.prodname_dependabot %} will alert your users about the issue, without offering any safe version to update to.
|
||||
|
||||
We recommend you take the following steps in these different situations:
|
||||
|
||||
- If a fix version is imminently available, and you are able to, wait to disclose the issue when the fix is ready.
|
||||
- If a fix version is in development but not yet available, mention this in the advisory, and edit the advisory later, after publication.
|
||||
- If you are not planning to fix the issue, be clear about it in the advisory so that your users don't contact you to ask when a fix will be made. In this case, it is helpful to include steps users can take to mitigate the issue.
|
||||
|
||||
{% endwarning %}
|
||||
|
||||
When you publish a draft advisory from a public repository, everyone is able to see:
|
||||
|
||||
- The current version of the advisory data.
|
||||
- Any advisory credits that the credited users have accepted.
|
||||
|
||||
{% note %}
|
||||
|
||||
**Note**: The general public will never have access to the edit history of the advisory, and will only see the published version.
|
||||
|
||||
{% endnote %}
|
||||
|
||||
After you publish a security advisory, the URL for the security advisory will remain the same as before you published the security advisory. Anyone with read access to the repository can see the security advisory. Collaborators on the security advisory can continue to view past conversations, including the full comment stream, in the security advisory unless someone with admin permissions removes the collaborator from the security advisory.
|
||||
|
||||
If you need to update or correct information in a security advisory that you've published, you can edit the security advisory. For more information, see "[Editing a security advisory](/github/managing-security-vulnerabilities/editing-a-security-advisory)."
|
||||
|
||||
### Requesting a CVE identification number
|
||||
|
||||
Anyone with admin permissions to a security advisory can request a CVE identification number for the security advisory.
|
||||
|
||||
{% data reusables.repositories.request-security-advisory-cve-id %} For more information, see "[About {% data variables.product.prodname_security_advisories %}](/github/managing-security-vulnerabilities/about-github-security-advisories#cve-identification-numbers)."
|
||||
|
||||
{% data reusables.repositories.navigate-to-repo %}
|
||||
{% data reusables.repositories.sidebar-security %}
|
||||
{% data reusables.repositories.sidebar-advisories %}
|
||||
4. In the "Security Advisories" list, click the security advisory you'd like to request a CVE identification number for.
|
||||
|
||||
5. Use the **Publish advisory** drop-down menu, and click **Request CVE**.
|
||||
|
||||
6. Click **Request CVE**.
|
||||
|
||||
|
||||
### Publishing a security advisory
|
||||
|
||||
Publishing a security advisory deletes the temporary private fork for the security advisory.
|
||||
|
||||
{% data reusables.repositories.navigate-to-repo %}
|
||||
{% data reusables.repositories.sidebar-security %}
|
||||
{% data reusables.repositories.sidebar-advisories %}
|
||||
4. In the "Security Advisories" list, click the security advisory you'd like to publish.
|
||||
|
||||
5. At the bottom of the page, click **Publish advisory**.
|
||||
|
||||
|
||||
### {% data variables.product.prodname_dependabot_alerts %} for published security advisories
|
||||
|
||||
{% data reusables.repositories.github-reviews-security-advisories %}
|
||||
|
||||
### Further reading
|
||||
|
||||
- "[Withdrawing a security advisory](/github/managing-security-vulnerabilities/withdrawing-a-security-advisory)"
|
||||
@@ -1,27 +0,0 @@
|
||||
---
|
||||
title: Removing a collaborator from a security advisory
|
||||
intro: 'When you remove a collaborator from a security advisory, they lose read and write access to the security advisory''s discussion and metadata.'
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
---
|
||||
|
||||
People with admin permissions to a security advisory can remove collaborators from the security advisory.
|
||||
|
||||
### Removing a collaborator from a security advisory
|
||||
|
||||
{% data reusables.repositories.security-advisory-collaborators-public-repositories %}
|
||||
|
||||
{% data reusables.repositories.navigate-to-repo %}
|
||||
{% data reusables.repositories.sidebar-security %}
|
||||
{% data reusables.repositories.sidebar-advisories %}
|
||||
4. In the "Security Advisories" list, click the security advisory you'd like to remove a collaborator from.
|
||||
|
||||
5. On the right side of the page, under "Collaborators", find the name of the user or team you'd like to remove from the security advisory.
|
||||
|
||||
6. Next to the collaborator you want to remove, click the **X** icon.
|
||||
|
||||
|
||||
### Further reading
|
||||
|
||||
- "[Permission levels for security advisories](/github/managing-security-vulnerabilities/permission-levels-for-security-advisories)"
|
||||
- "[Adding a collaborator to a security advisory](/github/managing-security-vulnerabilities/adding-a-collaborator-to-a-security-advisory)"
|
||||
@@ -1,103 +0,0 @@
|
||||
---
|
||||
title: Troubleshooting Dependabot errors
|
||||
intro: 'Sometimes {% data variables.product.prodname_dependabot %} is unable to raise a pull request to update your dependencies. You can review the error and unblock {% data variables.product.prodname_dependabot %}.'
|
||||
shortTitle: Troubleshooting errors
|
||||
redirect_from:
|
||||
- /github/managing-security-vulnerabilities/troubleshooting-github-dependabot-errors
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
---
|
||||
|
||||
{% data reusables.dependabot.beta-note %}
|
||||
|
||||
### About {% data variables.product.prodname_dependabot %} errors
|
||||
|
||||
{% data reusables.dependabot.pull-request-introduction %}
|
||||
|
||||
If anything prevents {% data variables.product.prodname_dependabot %} from raising a pull request, this is reported as an error.
|
||||
|
||||
### Investigating errors with {% data variables.product.prodname_dependabot_security_updates %}
|
||||
|
||||
When {% data variables.product.prodname_dependabot %} is blocked from creating a pull request to fix a {% data variables.product.prodname_dependabot %} alert, it posts the error message on the alert. The {% data variables.product.prodname_dependabot_alerts %} view shows a list of any alerts that have not been resolved yet. To access the alerts view, click **{% data variables.product.prodname_dependabot_alerts %}** on the **Security** tab for the repository. Where a pull request that will fix the vulnerable dependency has been generated, the alert includes a link to that pull request.
|
||||
|
||||
|
||||
|
||||
There are three reasons why an alert may have no pull request link:
|
||||
|
||||
1. {% data variables.product.prodname_dependabot_security_updates %} are not enabled for the repository.
|
||||
1. The alert is for an indirect or transitive dependency that is not explicitly defined in a lock file.
|
||||
1. An error blocked {% data variables.product.prodname_dependabot %} from creating a pull request.
|
||||
|
||||
If an error blocked {% data variables.product.prodname_dependabot %} from creating a pull request, you can display details of the error by clicking the alert.
|
||||
|
||||
|
||||
|
||||
### Investigating errors with {% data variables.product.prodname_dependabot_version_updates %}
|
||||
|
||||
When {% data variables.product.prodname_dependabot %} is blocked from creating a pull request to update a dependency in an ecosystem, it posts the error icon on the manifest file. The manifest files that are managed by {% data variables.product.prodname_dependabot %} are listed on the {% data variables.product.prodname_dependabot %} tab. To access this tab, on the **Insights** tab for the repository click **Dependency graph**, and then click the **{% data variables.product.prodname_dependabot %}** tab.
|
||||
|
||||
|
||||
|
||||
To see the log file for any manifest file, click the **Last checked TIME ago** link. When you display the log file for a manifest that's shown with an error symbol (for example, Maven in the screenshot above), any errors are also displayed.
|
||||
|
||||
|
||||
|
||||
### Understanding {% data variables.product.prodname_dependabot %} errors
|
||||
|
||||
Pull requests for security updates act to upgrade a vulnerable dependency to the minimum version that includes a fix for the vulnerability. In contrast, pull requests for version updates act to upgrade a dependency to the latest version allowed by the package manifest and {% data variables.product.prodname_dependabot %} configuration files. Consequently, some errors are specific to one type of update.
|
||||
|
||||
#### {% data variables.product.prodname_dependabot %} cannot update DEPENDENCY to a non-vulnerable version
|
||||
|
||||
**Security updates only.** {% data variables.product.prodname_dependabot %} cannot create a pull request to update the vulnerable dependency to a secure version without breaking other dependencies in the dependency graph for this repository.
|
||||
|
||||
Every application that has dependencies has a dependency graph, that is, a directed acyclic graph of every package version that the application directly or indirectly depends on. Every time a dependency is updated, this graph must resolve otherwise the application won't build. When an ecosystem has a deep and complex dependency graph, for example, npm and RubyGems, it is often impossible to upgrade a single dependency without upgrading the whole ecosystem.
|
||||
|
||||
The best way to avoid this problem is to stay up to date with the most recently released versions, for example, by enabling version updates. This increases the likelihood that a vulnerability in one dependency can be resolved by a simple upgrade that doesn't break the dependency graph. For more information, see "[Enabling and disabling version updates](/github/administering-a-repository/enabling-and-disabling-version-updates)."
|
||||
|
||||
#### {% data variables.product.prodname_dependabot %} cannot update to the required version as there is already an open pull request for the latest version
|
||||
|
||||
**Security updates only.** {% data variables.product.prodname_dependabot %} will not create a pull request to update the vulnerable dependency to a secure version because there is already an open pull request to update this dependency. You will see this error when a vulnerability is detected in a single dependency and there's already an open pull request to update the dependency to the latest version.
|
||||
|
||||
There are two options: you can review the open pull request and merge it as soon as you are confident that the change is safe, or close that pull request and trigger a new security update pull request. For more information, see "[Triggering a {% data variables.product.prodname_dependabot %} pull request manually](#triggering-a-dependabot-pull-request-manually)."
|
||||
|
||||
#### {% data variables.product.prodname_dependabot %} timed out during its update
|
||||
|
||||
{% data variables.product.prodname_dependabot %} took longer than the maximum time allowed to assess the update required and prepare a pull request. This error is usually seen only for large repositories with many manifest files, for example, npm or yarn monorepo projects with hundreds of *package.json* files. Updates to the Composer ecosystem also take longer to assess and may time out.
|
||||
|
||||
This error is difficult to address. If a version update times out, you could specify the most important dependencies to update using the `allow` parameter or, alternatively, use the `ignore` parameter to exclude some dependencies from updates. Updating your configuration might allow {% data variables.product.prodname_dependabot %} to review the version update and generate the pull request in the time available.
|
||||
|
||||
If a security update times out, you can reduce the chances of this happening by keeping the dependencies updated, for example, by enabling version updates. For more information, see "[Enabling and disabling version updates](/github/administering-a-repository/enabling-and-disabling-version-updates)."
|
||||
|
||||
#### {% data variables.product.prodname_dependabot %} cannot open any more pull requests
|
||||
|
||||
There's a limit on the number of open pull requests {% data variables.product.prodname_dependabot %} will generate. When this limit is reached, no new pull requests are opened and this error is reported. The best way to resolve this error is to review and merge some of the open pull requests.
|
||||
|
||||
There are separate limits for security and version update pull requests, so that open version update pull requests cannot block the creation of a security update pull request. The limit for security update pull requests is 10. By default, the limit for version updates is 5 but you can change this using the `open-pull-requests-limit` parameter in the configuration file. For more information, see "[Configuration options for dependency updates](/github/administering-a-repository/configuration-options-for-dependency-updates#open-pull-requests-limit)."
|
||||
|
||||
The best way to resolve this error is to merge or close some of the existing pull requests and trigger a new pull request manually. For more information, see "[Triggering a {% data variables.product.prodname_dependabot %} pull request manually](#triggering-a-dependabot-pull-request-manually)."
|
||||
|
||||
#### {% data variables.product.prodname_dependabot %} can't resolve or access your dependencies
|
||||
|
||||
If {% data variables.product.prodname_dependabot %} attempts to check whether dependency references need to be updated in a repository, but can't access one or more of the referenced files, the operation will fail with the error message "{% data variables.product.prodname_dependabot %} can't resolve your LANGUAGE dependency files." The API error type is `git_dependencies_not_reachable`.
|
||||
|
||||
Similarly, if {% data variables.product.prodname_dependabot %} can't access a private package registry in which a dependency is located, one of the following errors is generated:
|
||||
|
||||
* "Dependabot can't reach a dependency in a private package registry"<br>
|
||||
(API error type: `private_source_not_reachable`)
|
||||
* "Dependabot can't authenticate to a private package registry"<br>
|
||||
(API error type:`private_source_authentication_failure`)
|
||||
* "Dependabot timed out while waiting for a private package registry"<br>
|
||||
(API error type:`private_source_timed_out`)
|
||||
* "Dependabot couldn't validate the certificate for a private package registry"<br>
|
||||
(API error type:`private_source_certificate_failure`)
|
||||
|
||||
To allow {% data variables.product.prodname_dependabot %} to update the dependency references successfully, make sure that all of the referenced dependencies are hosted at accessible locations.
|
||||
|
||||
**Version updates only.** {% data reusables.dependabot.private-dependencies-note %} Additionally, {% data variables.product.prodname_dependabot %} doesn't support private {% data variables.product.prodname_dotcom %} dependencies for all package managers. For more information, see "[About Dependabot version updates](/github/administering-a-repository/about-dependabot-version-updates#supported-repositories-and-ecosystems)."
|
||||
|
||||
### Triggering a {% data variables.product.prodname_dependabot %} pull request manually
|
||||
|
||||
If you unblock {% data variables.product.prodname_dependabot %}, you can manually trigger a fresh attempt to create a pull request.
|
||||
|
||||
- **Security updates**—display the {% data variables.product.prodname_dependabot %} alert that shows the error you have fixed and click **Create {% data variables.product.prodname_dependabot %} security update**.
|
||||
- **Version updates**—on the **Insights** tab for the repository click **Dependency graph**, and then click the **Dependabot** tab. Click **Last checked *TIME* ago** to see the log file that {% data variables.product.prodname_dependabot %} generated during the last check for version updates. Click **Check for updates**.
|
||||
@@ -1,101 +0,0 @@
|
||||
---
|
||||
title: Troubleshooting the detection of vulnerable dependencies
|
||||
intro: 'If the dependency information reported by {% data variables.product.product_name %} is not what you expected, there are a number of points to consider, and various things you can check.'
|
||||
shortTitle: Troubleshooting detection
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
---
|
||||
|
||||
The results of dependency detection reported by {% data variables.product.product_name %} may be different from the results returned by other tools. There are good reasons for this and it's helpful to understand how {% data variables.product.prodname_dotcom %} determines dependencies for your project.
|
||||
|
||||
### Why do some dependencies seem to be missing?
|
||||
|
||||
{% data variables.product.prodname_dotcom %} generates and displays dependency data differently than other tools. Consequently, if you've been using another tool to identify dependencies you will almost certainly see different results. Consider the following:
|
||||
|
||||
* {% data variables.product.prodname_advisory_database %} is one of the data sources that {% data variables.product.prodname_dotcom %} uses to identify vulnerable dependencies. It's a free, curated database of vulnerability information for common package ecosystems on {% data variables.product.prodname_dotcom %}. It includes both data reported directly to {% data variables.product.prodname_dotcom %} from {% data variables.product.prodname_security_advisories %}, as well as official feeds and community sources. This data is reviewed and curated by {% data variables.product.prodname_dotcom %} to ensure that false or unactionable information is not shared with the development community. For more information, see "[Browsing security vulnerabilities in the {% data variables.product.prodname_advisory_database %}](/github/managing-security-vulnerabilities/browsing-security-vulnerabilities-in-the-github-advisory-database)" and "[About {% data variables.product.prodname_security_advisories %}](/github/managing-security-vulnerabilities/about-github-security-advisories)."
|
||||
* The dependency graph parses all known package manifest files in a user’s repository. For example, for npm it will parse the _package-lock.json_ file. It constructs a graph of all of the repository’s dependencies and public dependents. This happens when you enable the dependency graph and when anyone pushes to the default branch, and it includes commits that makes changes to a supported manifest format. For more information, see "[About the dependency graph](/github/visualizing-repository-data-with-graphs/about-the-dependency-graph)."
|
||||
* {% data variables.product.prodname_dependabot %} scans any push, to the default branch, that contains a manifest file. When a new vulnerability record is added, it scans all existing repositories and generates an alert for each vulnerable repository. {% data variables.product.prodname_dependabot_alerts %} are aggregated at the repository level, rather than creating one alert per vulnerability. For more information, see "[About alerts for vulnerable dependencies](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)."
|
||||
* {% data variables.product.prodname_dependabot_security_updates %} are triggered when you receive an alert about a vulnerable dependency in your repository. Where possible, {% data variables.product.prodname_dependabot %} creates a pull request in your repository to upgrade the vulnerable dependency to the minimum possible secure version needed to avoid the vulnerability. For more information, see "[About {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/about-dependabot-security-updates)" and "[Troubleshooting {% data variables.product.prodname_dependabot %} errors](/github/managing-security-vulnerabilities/troubleshooting-dependabot-errors)."
|
||||
|
||||
{% data variables.product.prodname_dependabot %} doesn't scan repositories for vulnerable dependencies on a schedule, but rather when something changes. For example, a scan is triggered when a new dependency is added ({% data variables.product.prodname_dotcom %} checks for this on every push), or when a new vulnerability is discovered and added to the advisory database.
|
||||
|
||||
### Why don't I get vulnerability alerts for some ecosystems?
|
||||
|
||||
{% data variables.product.prodname_dotcom %} limits its support for vulnerability alerts to a set of ecosystems where we can provide high-quality, actionable data. Curated vulnerabilities in the {% data variables.product.prodname_advisory_database %}, the dependency graph, {% data variables.product.prodname_dependabot_alerts %}, and {% data variables.product.prodname_dependabot %} security updates are provided for several ecosystems, including Java’s Maven, JavaScript’s npm and Yarn, .NET’s NuGet, Python’s pip, Ruby's RubyGems, and PHP’s Composer. We'll continue to add support for more ecosystems over time. For an overview of the package ecosystems that we support, see "[About the dependency graph](/github/visualizing-repository-data-with-graphs/about-the-dependency-graph#supported-package-ecosystems)."
|
||||
|
||||
It's worth noting that [{% data variables.product.prodname_dotcom %} Security Advisories](/github/managing-security-vulnerabilities/about-github-security-advisories) may exist for other ecosystems. The information in a security advisory is provided by the maintainers of a particular repository. This data is not curated in the same way as information for the supported ecosystems.
|
||||
|
||||
**Check**: Does the uncaught vulnerability apply to an unsupported ecosystem?
|
||||
|
||||
### Does the dependency graph only find dependencies in manifests and lockfiles?
|
||||
|
||||
The dependency graph includes information on dependencies that are explicitly declared in your environment. That is, dependencies that are specified in a manifest or a lockfile. The dependency graph generally also includes transitive dependencies, even when they aren't specified in a lockfile, by looking at the dependencies of the dependencies in a manifest file.
|
||||
|
||||
{% data variables.product.prodname_dependabot_alerts %} advise you about dependencies you should update, including transitive dependencies, where the version can be determined from a manifest or a lockfile. {% data variables.product.prodname_dependabot %} security updates only suggests a change where it can directly "fix" the dependency, that is, when these are:
|
||||
* Direct dependencies explicitly declared in a manifest or lockfile
|
||||
* Transitive dependencies declared in a lockfile
|
||||
|
||||
The dependency graph doesn't include “loose” dependencies. “Loose” dependencies are individual files that are copied from another source and checked into the repository directly or within an archive (such as a ZIP or JAR file), rather than being referenced by in a package manager’s manifest or lockfile.
|
||||
|
||||
**Check**: Is the uncaught vulnerability for a component that's not specified in the repository's manifest or lockfile?
|
||||
|
||||
### Does the dependency graph detect dependencies specified using variables?
|
||||
|
||||
The dependency graph analyzes manifests as they’re pushed to {% data variables.product.prodname_dotcom %}. The dependency graph doesn't, therefore, have access to the build environment of the project, so it can't resolve variables used within manifests. If you use variables within a manifest to specify the name, or more commonly the version of a dependency, then that dependency will not be included in the dependency graph.
|
||||
|
||||
**Check**: Is the missing dependency declared in the manifest by using a variable for its name or version?
|
||||
|
||||
### Are there limits which affect the dependency graph data?
|
||||
|
||||
Yes, the dependency graph has two categories of limits:
|
||||
|
||||
1. **Processing limits**
|
||||
|
||||
These affect the dependency graph displayed within {% data variables.product.prodname_dotcom %} and also prevent {% data variables.product.prodname_dependabot_alerts %} being created.
|
||||
|
||||
Manifests over 0.5 MB in size are only processed for enterprise accounts. For other accounts, manifests over 0.5 MB are ignored and will not create {% data variables.product.prodname_dependabot_alerts %}.
|
||||
|
||||
By default, {% data variables.product.prodname_dotcom %} will not process more than 20 manifests per repository. {% data variables.product.prodname_dependabot_alerts %} are not be created for manifests beyond this limit. If you need to increase the limit, contact {% data variables.contact.contact_support %}.
|
||||
|
||||
2. **Visualization limits**
|
||||
|
||||
These affect what's displayed in the dependency graph within {% data variables.product.prodname_dotcom %}. However, they don't affect the {% data variables.product.prodname_dependabot_alerts %} that are created.
|
||||
|
||||
The Dependencies view of the dependency graph for a repository only displays 100 manifests. Typically this is adequate as it is significantly higher than the processing limit described above. In situations where the processing limit is over 100, {% data variables.product.prodname_dependabot_alerts %} are still created for any manifests that are not shown within {% data variables.product.prodname_dotcom %}.
|
||||
|
||||
**Check**: Is the missing dependency in a manifest file that's over 0.5 MB, or in a repository with a large number of manifests?
|
||||
|
||||
### Does {% data variables.product.prodname_dependabot %} generate alerts for vulnerabilities that have been known for many years?
|
||||
|
||||
The {% data variables.product.prodname_advisory_database %} was launched in November 2019, and initially back-filled to include vulnerability information for the supported ecosystems, starting from 2017. When adding CVEs to the database, we prioritize curating newer CVEs, and CVEs affecting newer versions of software.
|
||||
|
||||
Some information on older vulnerabilities is available, especially where these CVEs are particularly widespread, however some old vulnerabilities are not included in the {% data variables.product.prodname_advisory_database %}. If there's a specific old vulnerability that you need to be included in the database, contact {% data variables.contact.contact_support %}.
|
||||
|
||||
**Check**: Does the uncaught vulnerability have a publish date earlier than 2017 in the National Vulnerability Database?
|
||||
|
||||
### Why does {% data variables.product.prodname_advisory_database %} use a subset of published vulnerability data?
|
||||
|
||||
Some third-party tools use uncurated CVE data that isn't checked or filtered by a human. This means that CVEs with tagging or severity errors, or other quality issues, will cause more frequent, more noisy, and less useful alerts.
|
||||
|
||||
Since {% data variables.product.prodname_dependabot %} uses curated data in the {% data variables.product.prodname_advisory_database %}, the volume of alerts may be lower, but the alerts you do receive will be accurate and relevant.
|
||||
|
||||
### Does each dependency vulnerability generate a separate alert?
|
||||
|
||||
When a dependency has multiple vulnerabilities, only one aggregated alert is generated for that dependency, instead of one alert per vulnerability.
|
||||
|
||||
The {% data variables.product.prodname_dependabot_alerts %} count in {% data variables.product.prodname_dotcom %} shows a total for the number of alerts, that is, the number of dependencies with vulnerabilities, not the number of vulnerabilities.
|
||||
|
||||
|
||||
|
||||
When you click to display the alert details, you can see how many vulnerabilities are included in the alert.
|
||||
|
||||
|
||||
|
||||
**Check**: If there is a discrepancy in the totals you are seeing, check that you are not comparing alert numbers with vulnerability numbers.
|
||||
|
||||
### Further reading
|
||||
|
||||
- "[About alerts for vulnerable dependencies](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)"
|
||||
- "[Viewing and updating vulnerable dependencies in your repository](/github/managing-security-vulnerabilities/viewing-and-updating-vulnerable-dependencies-in-your-repository)"
|
||||
- "[Managing security and analysis settings for your repository](/github/administering-a-repository/managing-security-and-analysis-settings-for-your-repository)"
|
||||
- "[Troubleshooting {% data variables.product.prodname_dependabot %} errors](/github/managing-security-vulnerabilities/troubleshooting-dependabot-errors)"
|
||||
@@ -1,41 +0,0 @@
|
||||
---
|
||||
title: Viewing and updating vulnerable dependencies in your repository
|
||||
intro: 'If {% data variables.product.product_name %} discovers vulnerable dependencies in your project, you can view them on the Dependabot alerts tab of your repository. Then, you can update your project to resolve or dismiss the vulnerability.'
|
||||
redirect_from:
|
||||
- /articles/viewing-and-updating-vulnerable-dependencies-in-your-repository
|
||||
permissions: Repository administrators and organization owners can view and update dependencies.
|
||||
shortTitle: Viewing and updating vulnerable dependencies
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
---
|
||||
Your repository's {% data variables.product.prodname_dependabot %} alerts tab lists all open and closed {% data variables.product.prodname_dependabot_alerts %} and corresponding {% data variables.product.prodname_dependabot_security_updates %}. You can sort the list of alerts using the drop-down menu, and you can click into specific alerts for more details. For more information, see "[About alerts for vulnerable dependencies](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)."
|
||||
|
||||
You can enable automatic security updates for any repository that uses {% data variables.product.prodname_dependabot_alerts %} and the dependency graph. For more information, see "[About {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/about-dependabot-security-updates)."
|
||||
|
||||
{% data reusables.repositories.dependency-review %}
|
||||
|
||||
### About updates for vulnerable dependencies in your repository
|
||||
|
||||
{% data variables.product.product_name %} generates {% data variables.product.prodname_dependabot_alerts %} when we detect that your codebase is using dependencies with known vulnerabilities. For repositories where {% data variables.product.prodname_dependabot_security_updates %} are enabled, when {% data variables.product.product_name %} detects a vulnerable dependency in the default branch, {% data variables.product.prodname_dependabot %} creates a pull request to fix it. The pull request will upgrade the dependency to the minimum possible secure version needed to avoid the vulnerability.
|
||||
|
||||
### Viewing and updating vulnerable dependencies
|
||||
|
||||
{% data reusables.repositories.navigate-to-repo %}
|
||||
{% data reusables.repositories.sidebar-security %}
|
||||
{% data reusables.repositories.sidebar-dependabot-alerts %}
|
||||
1. Click the alert you'd like to view.
|
||||
|
||||
1. Review the details of the vulnerability and, if available, the pull request containing the automated security update.
|
||||
1. Optionally, if there isn't already a {% data variables.product.prodname_dependabot_security_updates %} update for the alert, to create a pull request to resolve the vulnerability, click **Create {% data variables.product.prodname_dependabot %} security update**.
|
||||
|
||||
1. When you're ready to update your dependency and resolve the vulnerability, merge the pull request. Each pull request raised by {% data variables.product.prodname_dependabot %} includes information on commands you can use to control {% data variables.product.prodname_dependabot %}. For more information, see "[Managing pull requests for dependency updates](/github/administering-a-repository/managing-pull-requests-for-dependency-updates#managing-dependabot-pull-requests-with-comment-commands)."
|
||||
1. Optionally, if the alert is being fixed, if it's incorrect, or located in unused code, use the "Dismiss" drop-down, and click a reason for dismissing the alert.
|
||||
|
||||
|
||||
### Further reading
|
||||
|
||||
- "[About alerts for vulnerable dependencies](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)"
|
||||
- "[Configuring {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/configuring-dependabot-security-updates)"
|
||||
- "[Managing security and analysis settings for your repository](/github/administering-a-repository/managing-security-and-analysis-settings-for-your-repository)"
|
||||
- "[Troubleshooting the detection of vulnerable dependencies](/github/managing-security-vulnerabilities/troubleshooting-the-detection-of-vulnerable-dependencies)"
|
||||
- "[Troubleshooting {% data variables.product.prodname_dependabot %} errors](/github/managing-security-vulnerabilities/troubleshooting-dependabot-errors)"
|
||||
@@ -1,12 +0,0 @@
|
||||
---
|
||||
title: Withdrawing a security advisory
|
||||
intro: You can withdraw a security advisory that you've published.
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
---
|
||||
|
||||
If you publish a security advisory in error, you can withdraw the security advisory by contacting {% data variables.contact.contact_support %}.
|
||||
|
||||
### Further reading
|
||||
|
||||
- [Editing a security advisory](/github/managing-security-vulnerabilities/editing-a-security-advisory)
|
||||
Reference in New Issue
Block a user