diff --git a/content/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file.md b/content/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file.md index 80c8e8ca1a..fdd0f241fb 100644 --- a/content/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file.md +++ b/content/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file.md @@ -894,8 +894,9 @@ You can give {% data variables.product.prodname_dependabot %} access to private - Docker - Gradle - Maven -- Npm -- Nuget +- npm +- Nuget{% ifversion dependabot-updates-pub-private-registry %} +- pub{% endif %} - Python - Yarn @@ -1217,6 +1218,33 @@ registries: {% endraw %} +{% ifversion dependabot-updates-pub-private-registry %} + +### `pub-repository` + +The `pub-repository` type supports a URL and a token. + +{% raw %} + +```yaml +registries: + my-pub-registry: + type: pub-repository + url: https://example-private-pub-repo.dev/optional-path + token: ${{secrets.MY_PUB_TOKEN}} +updates: + - package-ecosystem: "pub" + directory: "/" + schedule: + interval: "weekly" + registries: + - my-pub-registry +``` + +{% endraw %} + +{% endif %} + ### `python-index` The `python-index` type supports username and password, or token. {% data reusables.dependabot.password-definition %} diff --git a/content/code-security/dependabot/working-with-dependabot/guidance-for-the-configuration-of-private-registries-for-dependabot.md b/content/code-security/dependabot/working-with-dependabot/guidance-for-the-configuration-of-private-registries-for-dependabot.md index c4863dee97..596a4583fc 100644 --- a/content/code-security/dependabot/working-with-dependabot/guidance-for-the-configuration-of-private-registries-for-dependabot.md +++ b/content/code-security/dependabot/working-with-dependabot/guidance-for-the-configuration-of-private-registries-for-dependabot.md @@ -25,16 +25,20 @@ This article contains recommendations and advice to help you configure {% data v - Extra configuration options, wherever appropriate (for example, npm has a configuration file that needs to be set). - Advice about configuring registry hosts. -You'll find detailed guidance for the setup of the following package managers and registry hosts: +You'll find detailed guidance for the setup of the following package managers: - [Bundler](#bundler) - [Docker](#docker) - [Gradle](#gradle) - [Maven](#maven) - [npm](#npm) -- [Nuget](#nuget) +- [Nuget](#nuget){% ifversion dependabot-updates-pub-private-registry %} +- [pub](#pub){% endif %} - [Python](#python) - [Yarn](#yarn) + +You'll also find recommendations for the setup of the following registry hosts: + - [Artifactory](#artifactory) - [Azure Artifacts](#azure-artifacts) - [{% data variables.product.prodname_registry %} registry](#data-variablesproductprodname_registry--registry) @@ -350,6 +354,41 @@ registries: {% endraw %} +{% ifversion dependabot-updates-pub-private-registry %} + +### pub + +You can define the private registry configuration in a `dependabot.yml` file using the `pub-repository` type. For more information, see "[AUTOTITLE](/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#pub-repository)." + +{% raw %} + +```yaml +registries: + my-pub-registry: + type: pub-repository + url: https://example-private-pub-repo.dev/optional-path + token: ${{secrets.MY_PUB_TOKEN}} +updates: + - package-ecosystem: "pub" + directory: "/" + schedule: + interval: "weekly" + registries: + - my-pub-registry +``` + +{% endraw %} + +#### Notes + +{% data reusables.dependabot.access-private-dependencies-link %} + +pub supports URL and token authentication. The URL used for the registry should match the pub-hosted URL. For more information, see [Hosted Pub Repository Specification Version 2](https://github.com/dart-lang/pub/blob/master/doc/repository-spec-v2.md#hosted-url) in the `github/dart-lang/pub` repository. + +{% data variables.product.prodname_dependabot %} doesn't support overrides to the default package registry. For more information about overrides and why some users may implement them, see [Overriding the default package repository](https://dart.dev/tools/pub/custom-package-repositories#default-override) in the Dart documentation. + +{% endif %} + ### Python Supported by Artifactory, Azure Artifacts, Nexus, and ProGet. The {% data variables.product.prodname_registry %} registry is not supported. @@ -397,7 +436,7 @@ registries: {% data reusables.dependabot.access-private-dependencies-link %} -'url' should contain the URL, organization, and the "feed" or repository. +`url` should contain the URL, organization, and the "feed" or repository. ### Yarn diff --git a/data/features/dependabot-updates-pub-private-registry.yml b/data/features/dependabot-updates-pub-private-registry.yml new file mode 100644 index 0000000000..8009218e22 --- /dev/null +++ b/data/features/dependabot-updates-pub-private-registry.yml @@ -0,0 +1,6 @@ +# Reference: issue #13480 +# Support for pub private registries with Dependabot - [GA] +versions: + fpt: '*' + ghec: '*' + ghes: '>3.12' diff --git a/data/reusables/dependabot/supported-package-managers.md b/data/reusables/dependabot/supported-package-managers.md index 17e0f532cc..17085c6cad 100644 --- a/data/reusables/dependabot/supported-package-managers.md +++ b/data/reusables/dependabot/supported-package-managers.md @@ -25,7 +25,7 @@ pipenv | `pip` | <= 2021-05-29 | {% octicon "x" aria-label {% ifversion dependabot-PEP621-support %}[pip-compile](#pip-and-pip-compile){% else %}pip-compile{% endif %} | `pip` | 6.1.0 | {% octicon "x" aria-label="Not supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | {% ifversion dependabot-updates-pnpm-support %}[pnpm](#pnpm) | `npm` | v7, v8 | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | {% endif %}poetry | `pip` | v1 | {% octicon "x" aria-label="Not supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} |{% ifversion fpt or ghec or ghes %} -[pub](#pub) | `pub` | v2 | {% octicon "x" aria-label="Not supported" %} | {% octicon "x" aria-label="Not supported" %} | {% octicon "x" aria-label="Not supported" %} |{% endif %}{% ifversion dependabot-updates-swift-support %} +[pub](#pub) | `pub` | v2 | {% ifversion dependabot-updates-pub-private-registry %}{% octicon "check" aria-label="Supported" %}{% else %}{% octicon "x" aria-label="Not supported" %}{% endif %} | {% ifversion dependabot-updates-pub-private-registry %}{% octicon "check" aria-label="Supported" %}{% else %}{% octicon "x" aria-label="Not supported" %}{% endif %} | {% octicon "x" aria-label="Not supported" %} |{% endif %}{% ifversion dependabot-updates-swift-support %} [Swift](#swift) | `swift` | v5 | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} (git only) | {% octicon "x" aria-label="Not supported" %} |{% endif %} [Terraform](#terraform) | `terraform` | >= 0.13, <= 1.5.x | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | Not applicable | {% ifversion dependabot-yarn-v3-update %}[yarn](#yarn) | `npm` | v1, v2, v3 | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %}|{% else %}yarn | `npm` | v1 | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | | @@ -126,11 +126,14 @@ pnpm is supported for {% data variables.product.prodname_dependabot_version_upda pnpm is supported for {% data variables.product.prodname_dependabot_version_updates %} only. {% data variables.product.prodname_dependabot_security_updates %} are not currently supported. {% endif %} -{% ifversion fpt or ghec or ghes %} - #### pub {% data variables.product.prodname_dependabot %} won't perform an update for `pub` when the version that it tries to update to is ignored, even if an earlier version is available. + +{% ifversion dependabot-updates-pub-private-registry %} + +You can use {% data variables.product.prodname_dependabot %} to keep Dart dependencies up-to-date if you use private hosted pub repositories. For information about allowing {% data variables.product.prodname_dependabot %} to access private {% data variables.product.prodname_dotcom %} dependencies, see "[Allowing {% data variables.product.prodname_dependabot %} to access private dependencies](/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-dependabot-to-access-private-dependencies)." + {% endif %} {% ifversion dependabot-updates-swift-support %}