diff --git a/content/rest/dependabot/alerts.md b/content/rest/dependabot/alerts.md new file mode 100644 index 0000000000..34c08b5bdb --- /dev/null +++ b/content/rest/dependabot/alerts.md @@ -0,0 +1,21 @@ +--- +title: '{% data variables.product.prodname_dependabot_alerts %}' +allowTitleToDifferFromFilename: true +shortTitle: Alerts +intro: 'With the {% data variables.product.prodname_dependabot_alerts %} API, you can view and manage {% data variables.product.prodname_dependabot %} alerts for a repository.' +versions: + feature: dependabot-alerts-rest-api +topics: + - API +miniTocMaxHeadingLevel: 3 +--- + +{% note %} + +**Note**: The Dependabot alerts API is currently in public beta and subject to change. + +{% endnote %} + +## About the {% data variables.product.prodname_dependabot_alerts %} API + +The {% data variables.product.prodname_dependabot_alerts %} API lets you view {% data variables.product.prodname_dependabot %} alerts for a repository and update individual alerts. For more information, see "[About Dependabot alerts](/code-security/dependabot/dependabot-alerts/about-dependabot-alerts)." diff --git a/content/rest/dependabot/index.md b/content/rest/dependabot/index.md index c82be888af..815cdfc355 100644 --- a/content/rest/dependabot/index.md +++ b/content/rest/dependabot/index.md @@ -1,6 +1,6 @@ --- title: Dependabot -intro: 'With the Dependabot Secrets API, you can manage and control Dependabot secrets for an organization or repository.' +intro: 'With the {% data variables.product.prodname_dependabot %} API, you can manage {% data variables.product.prodname_dependabot %} alerts and secrets for an organization or repository.' allowTitleToDifferFromFilename: true versions: fpt: '*' @@ -10,6 +10,7 @@ topics: - API miniTocMaxHeadingLevel: 3 children: + - /alerts - /secrets redirect_from: - /rest/reference/dependabot diff --git a/data/features/dependabot-alerts-rest-api.yml b/data/features/dependabot-alerts-rest-api.yml new file mode 100644 index 0000000000..09816732df --- /dev/null +++ b/data/features/dependabot-alerts-rest-api.yml @@ -0,0 +1,5 @@ +# Reference: Issue #7328 - Dependabot alerts REST API + +versions: + fpt: '*' + ghec: '*' diff --git a/lib/redirects/static/client-side-rest-api-redirects.json b/lib/redirects/static/client-side-rest-api-redirects.json index 5c7f23a24f..fc4b5f8ff2 100644 --- a/lib/redirects/static/client-side-rest-api-redirects.json +++ b/lib/redirects/static/client-side-rest-api-redirects.json @@ -590,6 +590,10 @@ "/rest/repos#create-or-update-file-contents": "/rest/repos/contents#create-or-update-file-contents", "/rest/repos#delete-a-file": "/rest/repos/contents#delete-a-file", "/rest/repos#list-repository-contributors": "/rest/repos/repos#list-repository-contributors", + "/rest/dependabot#list-dependabot-alerts-for-a-repository": "/rest/dependabot/alerts#list-dependabot-alerts-for-a-repository", + "/rest/dependabot#alerts": "/rest/dependabot/alerts", + "/rest/dependabot#get-a-dependabot-alert": "/rest/dependabot/alerts#get-a-dependabot-alert", + "/rest/dependabot#update-a-dependabot-alert": "/rest/dependabot/alerts#update-a-dependabot-alert", "/rest/dependabot#list-repository-secrets": "/rest/dependabot/secrets#list-repository-secrets", "/rest/dependabot#get-a-repository-public-key": "/rest/dependabot/secrets#get-a-repository-public-key", "/rest/dependabot#get-a-repository-secret": "/rest/dependabot/secrets#get-a-repository-secret", diff --git a/lib/rest/static/apps/enabled-for-apps.json b/lib/rest/static/apps/enabled-for-apps.json index af9baf45e4..054137e529 100644 --- a/lib/rest/static/apps/enabled-for-apps.json +++ b/lib/rest/static/apps/enabled-for-apps.json @@ -1409,6 +1409,24 @@ "verb": "delete", "requestPath": "/orgs/{org}/dependabot/secrets/{secret_name}/repositories/{repository_id}" }, + { + "slug": "list-dependabot-alerts-for-a-repository", + "subcategory": "alerts", + "verb": "get", + "requestPath": "/repos/{owner}/{repo}/dependabot/alerts" + }, + { + "slug": "get-a-dependabot-alert", + "subcategory": "alerts", + "verb": "get", + "requestPath": "/repos/{owner}/{repo}/dependabot/alerts/{alert_number}" + }, + { + "slug": "update-a-dependabot-alert", + "subcategory": "alerts", + "verb": "patch", + "requestPath": "/repos/{owner}/{repo}/dependabot/alerts/{alert_number}" + }, { "slug": "list-repository-secrets", "subcategory": "secrets", @@ -5180,6 +5198,24 @@ "verb": "delete", "requestPath": "/orgs/{org}/dependabot/secrets/{secret_name}/repositories/{repository_id}" }, + { + "slug": "list-dependabot-alerts-for-a-repository", + "subcategory": "alerts", + "verb": "get", + "requestPath": "/repos/{owner}/{repo}/dependabot/alerts" + }, + { + "slug": "get-a-dependabot-alert", + "subcategory": "alerts", + "verb": "get", + "requestPath": "/repos/{owner}/{repo}/dependabot/alerts/{alert_number}" + }, + { + "slug": "update-a-dependabot-alert", + "subcategory": "alerts", + "verb": "patch", + "requestPath": "/repos/{owner}/{repo}/dependabot/alerts/{alert_number}" + }, { "slug": "list-repository-secrets", "subcategory": "secrets", diff --git a/lib/rest/static/decorated/api.github.com.json b/lib/rest/static/decorated/api.github.com.json index 79163251f5..ebf0a06974 100644 --- a/lib/rest/static/decorated/api.github.com.json +++ b/lib/rest/static/decorated/api.github.com.json @@ -266463,6 +266463,2446 @@ ] }, "dependabot": { + "alerts": [ + { + "serverUrl": "https://api.github.com", + "verb": "get", + "requestPath": "/repos/{owner}/{repo}/dependabot/alerts", + "title": "List Dependabot alerts for a repository", + "category": "dependabot", + "subcategory": "alerts", + "parameters": [ + { + "name": "owner", + "description": "
The account owner of the repository. The name is not case sensitive.
", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + }, + { + "name": "repo", + "description": "The name of the repository. The name is not case sensitive.
", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + }, + { + "name": "state", + "description": "A comma-separated list of states. If specified, only alerts with these states will be returned.
\nCan be: dismissed, fixed, open
A comma-separated list of severities. If specified, only alerts with these severities will be returned.
\nCan be: low, medium, high, critical
A comma-separated list of ecosystems. If specified, only alerts for these ecosystems will be returned.
\nCan be: composer, go, maven, npm, nuget, pip, rubygems, rust
A comma-separated list of package names. If specified, only alerts for these packages will be returned.
", + "in": "query", + "schema": { + "type": "string" + } + }, + { + "name": "manifest", + "description": "A comma-separated list of full manifest paths. If specified, only alerts for these manifests will be returned.
", + "in": "query", + "schema": { + "type": "string" + } + }, + { + "name": "scope", + "description": "Scope of the dependency on a Dependabot alert.
", + "in": "query", + "schema": { + "type": [ + "string", + "null" + ], + "description": "The scope of the vulnerable dependency.", + "readOnly": true, + "enum": [ + "development", + "runtime", + null + ] + } + }, + { + "name": "sort", + "description": "The property by which to sort the results.\ncreated means when the alert was created.\nupdated means when the alert's state last changed.
The direction to sort the results by.
", + "in": "query", + "required": false, + "schema": { + "type": "string", + "enum": [ + "asc", + "desc" + ], + "default": "desc" + } + }, + { + "name": "page", + "description": "Page number of the results to fetch.
", + "in": "query", + "schema": { + "type": "integer", + "default": 1 + } + }, + { + "name": "per_page", + "description": "The number of results per page (max 100).
", + "in": "query", + "schema": { + "type": "integer", + "default": 30 + } + } + ], + "bodyParameters": [], + "enabledForGitHubApps": true, + "codeExamples": [ + { + "key": "default", + "request": { + "description": "Example", + "acceptHeader": "application/vnd.github.v3+json", + "parameters": { + "owner": "OWNER", + "repo": "REPO" + } + }, + "response": { + "statusCode": "200", + "contentType": "application/json", + "description": "Response
", + "example": [ + { + "number": 2, + "state": "dismissed", + "dependency": { + "package": { + "ecosystem": "pip", + "name": "django" + }, + "manifest_path": "path/to/requirements.txt", + "scope": "runtime" + }, + "security_advisory": { + "ghsa_id": "GHSA-rf4j-j272-fj86", + "cve_id": "CVE-2018-6188", + "summary": "Django allows remote attackers to obtain potentially sensitive information by leveraging data exposure from the confirm_login_allowed() method, as demonstrated by discovering whether a user account is inactive", + "description": "django.contrib.auth.forms.AuthenticationForm in Django 2.0 before 2.0.2, and 1.11.8 and 1.11.9, allows remote attackers to obtain potentially sensitive information by leveraging data exposure from the confirm_login_allowed() method, as demonstrated by discovering whether a user account is inactive.", + "severity": "high", + "identifiers": [ + { + "type": "GHSA", + "value": "GHSA-rf4j-j272-fj86" + }, + { + "type": "CVE", + "value": "CVE-2018-6188" + } + ], + "references": [ + { + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-6188" + }, + { + "url": "https://github.com/advisories/GHSA-rf4j-j272-fj86" + }, + { + "url": "https://usn.ubuntu.com/3559-1/" + }, + { + "url": "https://www.djangoproject.com/weblog/2018/feb/01/security-releases/" + }, + { + "url": "http://www.securitytracker.com/id/1040422" + } + ], + "published_at": "2018-10-03T21:13:54Z", + "updated_at": "2022-04-26T18:35:37Z", + "withdrawn_at": null, + "vulnerabilities": [ + { + "package": { + "ecosystem": "pip", + "name": "django" + }, + "severity": "high", + "vulnerable_version_range": ">= 2.0.0, < 2.0.2", + "first_patched_version": { + "identifier": "2.0.2" + } + }, + { + "package": { + "ecosystem": "pip", + "name": "django" + }, + "severity": "high", + "vulnerable_version_range": ">= 1.11.8, < 1.11.10", + "first_patched_version": { + "identifier": "1.11.10" + } + } + ], + "cvss": { + "vector_string": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", + "score": 7.5 + }, + "cwes": [ + { + "cwe_id": "CWE-200", + "name": "Exposure of Sensitive Information to an Unauthorized Actor" + } + ] + }, + "security_vulnerability": { + "package": { + "ecosystem": "pip", + "name": "django" + }, + "severity": "high", + "vulnerable_version_range": ">= 2.0.0, < 2.0.2", + "first_patched_version": { + "identifier": "2.0.2" + } + }, + "url": "https://api.github.com/repos/octocat/hello-world/dependabot/alerts/2", + "html_url": "https://github.com/octocat/hello-world/security/dependabot/2", + "created_at": "2022-06-15T07:43:03Z", + "updated_at": "2022-08-23T14:29:47Z", + "dismissed_at": "2022-08-23T14:29:47Z", + "dismissed_by": { + "login": "octocat", + "id": 1, + "node_id": "MDQ6VXNlcjE=", + "avatar_url": "https://github.com/images/error/octocat_happy.gif", + "gravatar_id": "", + "url": "https://api.github.com/users/octocat", + "html_url": "https://github.com/octocat", + "followers_url": "https://api.github.com/users/octocat/followers", + "following_url": "https://api.github.com/users/octocat/following{/other_user}", + "gists_url": "https://api.github.com/users/octocat/gists{/gist_id}", + "starred_url": "https://api.github.com/users/octocat/starred{/owner}{/repo}", + "subscriptions_url": "https://api.github.com/users/octocat/subscriptions", + "organizations_url": "https://api.github.com/users/octocat/orgs", + "repos_url": "https://api.github.com/users/octocat/repos", + "events_url": "https://api.github.com/users/octocat/events{/privacy}", + "received_events_url": "https://api.github.com/users/octocat/received_events", + "type": "User", + "site_admin": false + }, + "dismissed_reason": "tolerable_risk", + "dismissed_comment": "This alert is accurate but we use a sanitizer.", + "fixed_at": null + }, + { + "number": 1, + "state": "open", + "dependency": { + "package": { + "ecosystem": "pip", + "name": "ansible" + }, + "manifest_path": "path/to/requirements.txt", + "scope": "runtime" + }, + "security_advisory": { + "ghsa_id": "GHSA-8f4m-hccc-8qph", + "cve_id": "CVE-2021-20191", + "summary": "Insertion of Sensitive Information into Log File in ansible", + "description": "A flaw was found in ansible. Credentials, such as secrets, are being disclosed in console log by default and not protected by no_log feature when using those modules. An attacker can take advantage of this information to steal those credentials. The highest threat from this vulnerability is to data confidentiality.", + "severity": "medium", + "identifiers": [ + { + "type": "GHSA", + "value": "GHSA-8f4m-hccc-8qph" + }, + { + "type": "CVE", + "value": "CVE-2021-20191" + } + ], + "references": [ + { + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20191" + }, + { + "url": "https://access.redhat.com/security/cve/cve-2021-20191" + }, + { + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1916813" + } + ], + "published_at": "2021-06-01T17:38:00Z", + "updated_at": "2021-08-12T23:06:00Z", + "withdrawn_at": null, + "vulnerabilities": [ + { + "package": { + "ecosystem": "pip", + "name": "ansible" + }, + "severity": "medium", + "vulnerable_version_range": ">= 2.9.0, < 2.9.18", + "first_patched_version": { + "identifier": "2.9.18" + } + }, + { + "package": { + "ecosystem": "pip", + "name": "ansible" + }, + "severity": "medium", + "vulnerable_version_range": "< 2.8.19", + "first_patched_version": { + "identifier": "2.8.19" + } + }, + { + "package": { + "ecosystem": "pip", + "name": "ansible" + }, + "severity": "medium", + "vulnerable_version_range": ">= 2.10.0, < 2.10.7", + "first_patched_version": { + "identifier": "2.10.7" + } + } + ], + "cvss": { + "vector_string": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", + "score": 5.5 + }, + "cwes": [ + { + "cwe_id": "CWE-532", + "name": "Insertion of Sensitive Information into Log File" + } + ] + }, + "security_vulnerability": { + "package": { + "ecosystem": "pip", + "name": "ansible" + }, + "severity": "medium", + "vulnerable_version_range": "< 2.8.19", + "first_patched_version": { + "identifier": "2.8.19" + } + }, + "url": "https://api.github.com/repos/octocat/hello-world/dependabot/alerts/1", + "html_url": "https://github.com/octocat/hello-world/security/dependabot/1", + "created_at": "2022-06-14T15:21:52Z", + "updated_at": "2022-06-14T15:21:52Z", + "dismissed_at": null, + "dismissed_by": null, + "dismissed_reason": null, + "dismissed_comment": null, + "fixed_at": null + } + ], + "schema": { + "type": "array", + "items": { + "type": "object", + "properties": { + "number": { + "type": "integer", + "description": "The security alert number.", + "readOnly": true + }, + "state": { + "type": "string", + "description": "State of a Dependabot alert.", + "enum": [ + "dismissed", + "fixed", + "open" + ] + }, + "dependency": { + "type": "object", + "readOnly": true, + "properties": { + "package": { + "type": "object", + "description": "The details of the vulnerable package.", + "readOnly": true, + "properties": { + "ecosystem": { + "type": "string" + }, + "name": { + "type": "string" + } + } + }, + "manifest_path": { + "type": "string", + "description": "The path to the manifest filename.", + "readOnly": true + }, + "scope": { + "type": [ + "string", + "null" + ], + "description": "The scope of the vulnerable dependency.", + "readOnly": true, + "enum": [ + "development", + "runtime", + null + ] + } + } + }, + "security_advisory": { + "type": "object", + "description": "The details of the security advisory, including summary, description, and severity.", + "readOnly": true, + "properties": { + "ghsa_id": { + "type": "string" + }, + "cve_id": { + "type": [ + "string", + "null" + ] + }, + "summary": { + "type": "string" + }, + "description": { + "type": "string" + }, + "severity": { + "type": "string", + "enum": [ + "low", + "medium", + "high", + "critical" + ] + }, + "identifiers": { + "type": "array", + "items": { + "type": "object", + "properties": { + "type": { + "type": "string", + "enum": [ + "GHSA", + "CVE" + ] + }, + "value": { + "type": "string" + } + }, + "required": [ + "value", + "type" + ], + "additionalProperties": false + } + }, + "references": { + "type": "array", + "items": { + "type": "object", + "properties": { + "url": { + "type": "string", + "format": "uri" + } + }, + "required": [ + "url" + ], + "additionalProperties": false + } + }, + "cvss": { + "type": "object", + "properties": { + "score": { + "type": "number" + }, + "vector_string": { + "type": [ + "string", + "null" + ] + } + }, + "required": [ + "vector_string", + "score" + ], + "additionalProperties": false + }, + "cwes": { + "type": "array", + "items": { + "type": "object", + "properties": { + "cwe_id": { + "type": "string" + }, + "name": { + "type": "string" + } + }, + "required": [ + "cwe_id", + "name" + ], + "additionalProperties": false + } + }, + "published_at": { + "type": "string", + "format": "date-time" + }, + "updated_at": { + "type": "string", + "format": "date-time" + }, + "vulnerabilities": { + "type": "array", + "items": { + "type": "object", + "properties": { + "first_patched_version": { + "type": [ + "object", + "null" + ], + "properties": { + "identifier": { + "type": "string" + } + }, + "required": [ + "identifier" + ], + "additionalProperties": false + }, + "package": { + "type": "object", + "properties": { + "ecosystem": { + "type": "string" + }, + "name": { + "type": "string" + } + }, + "required": [ + "ecosystem", + "name" + ], + "additionalProperties": false + }, + "severity": { + "type": "string" + }, + "vulnerable_version_range": { + "type": "string" + } + }, + "required": [ + "package", + "severity", + "vulnerable_version_range", + "first_patched_version" + ], + "additionalProperties": false + } + }, + "withdrawn_at": { + "type": [ + "string", + "null" + ], + "format": "date-time" + } + }, + "required": [ + "cvss", + "cwes", + "ghsa_id", + "summary", + "description", + "severity", + "identifiers", + "references", + "published_at", + "updated_at", + "withdrawn_at", + "vulnerabilities" + ], + "additionalProperties": false + }, + "security_vulnerability": { + "type": "object", + "description": "The details of the vulnerability of a security advisory.", + "readOnly": true, + "properties": { + "package": { + "type": "object", + "description": "The details of the vulnerable package.", + "readOnly": true, + "properties": { + "ecosystem": { + "type": "string" + }, + "name": { + "type": "string" + } + } + }, + "severity": { + "type": "string" + }, + "vulnerable_version_range": { + "type": "string" + }, + "first_patched_version": { + "type": "object", + "properties": { + "identifier": { + "type": "string" + } + } + } + } + }, + "created_at": { + "type": "string", + "description": "The time that the alert was created in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.", + "format": "date-time", + "readOnly": true + }, + "updated_at": { + "type": "string", + "description": "The time that the alert was last updated in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.", + "format": "date-time", + "readOnly": true + }, + "url": { + "type": "string", + "description": "The REST API URL of the alert resource.", + "format": "uri", + "readOnly": true + }, + "html_url": { + "type": "string", + "description": "The GitHub URL of the alert resource.", + "format": "uri", + "readOnly": true + }, + "dismissed_at": { + "type": [ + "string", + "null" + ], + "description": "The time that the alert was dismissed in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.", + "format": "date-time", + "readOnly": true + }, + "dismissed_by": { + "anyOf": [ + { + "type": "null" + }, + { + "title": "Simple User", + "description": "Simple User", + "type": "object", + "properties": { + "name": { + "type": [ + "string", + "null" + ] + }, + "email": { + "type": [ + "string", + "null" + ] + }, + "login": { + "type": "string", + "examples": [ + "octocat" + ] + }, + "id": { + "type": "integer", + "examples": [ + 1 + ] + }, + "node_id": { + "type": "string", + "examples": [ + "MDQ6VXNlcjE=" + ] + }, + "avatar_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://github.com/images/error/octocat_happy.gif" + ] + }, + "gravatar_id": { + "type": [ + "string", + "null" + ], + "examples": [ + "41d064eb2195891e12d0413f63227ea7" + ] + }, + "url": { + "type": "string", + "format": "uri", + "examples": [ + "https://api.github.com/users/octocat" + ] + }, + "html_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://github.com/octocat" + ] + }, + "followers_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://api.github.com/users/octocat/followers" + ] + }, + "following_url": { + "type": "string", + "examples": [ + "https://api.github.com/users/octocat/following{/other_user}" + ] + }, + "gists_url": { + "type": "string", + "examples": [ + "https://api.github.com/users/octocat/gists{/gist_id}" + ] + }, + "starred_url": { + "type": "string", + "examples": [ + "https://api.github.com/users/octocat/starred{/owner}{/repo}" + ] + }, + "subscriptions_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://api.github.com/users/octocat/subscriptions" + ] + }, + "organizations_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://api.github.com/users/octocat/orgs" + ] + }, + "repos_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://api.github.com/users/octocat/repos" + ] + }, + "events_url": { + "type": "string", + "examples": [ + "https://api.github.com/users/octocat/events{/privacy}" + ] + }, + "received_events_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://api.github.com/users/octocat/received_events" + ] + }, + "type": { + "type": "string", + "examples": [ + "User" + ] + }, + "site_admin": { + "type": "boolean" + }, + "starred_at": { + "type": "string", + "examples": [ + "\"2020-07-09T00:17:55Z\"" + ] + } + }, + "required": [ + "avatar_url", + "events_url", + "followers_url", + "following_url", + "gists_url", + "gravatar_id", + "html_url", + "id", + "node_id", + "login", + "organizations_url", + "received_events_url", + "repos_url", + "site_admin", + "starred_url", + "subscriptions_url", + "type", + "url" + ] + } + ] + }, + "dismissed_reason": { + "type": [ + "string", + "null" + ], + "description": "**Required when the `state` is `dismissed`.** The reason for dismissing the Dependabot alert.", + "enum": [ + "fix_started", + "inaccurate", + "no_bandwidth", + "not_used", + "tolerable_risk", + null + ] + }, + "dismissed_comment": { + "type": [ + "string", + "null" + ], + "description": "An optional comment associated with the alert's dismissal. The maximum size is 280 characters.", + "maxLength": 280 + }, + "fixed_at": { + "type": [ + "string", + "null" + ], + "description": "The time that the alert was no longer detected and was considered fixed in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.", + "format": "date-time", + "readOnly": true + } + }, + "required": [ + "number", + "state", + "dependency", + "security_advisory", + "security_vulnerability", + "url", + "html_url", + "dismissed_at", + "dismissed_by", + "dismissed_reason", + "dismissed_comment", + "fixed_at", + "created_at", + "updated_at" + ] + } + } + } + } + ], + "previews": [], + "descriptionHTML": "You must use an access token with the security_events scope to use this endpoint with private repositories.\nYou can also use tokens with the public_repo scope for public repositories only.\nGitHub Apps must have Dependabot alerts read permission to use this endpoint.
OK
" + }, + { + "httpStatusCode": "304", + "description": "Not modified
" + }, + { + "httpStatusCode": "403", + "description": "Forbidden
" + }, + { + "httpStatusCode": "404", + "description": "Resource not found
" + }, + { + "httpStatusCode": "422", + "description": "Validation failed
" + } + ] + }, + { + "serverUrl": "https://api.github.com", + "verb": "get", + "requestPath": "/repos/{owner}/{repo}/dependabot/alerts/{alert_number}", + "title": "Get a Dependabot alert", + "category": "dependabot", + "subcategory": "alerts", + "parameters": [ + { + "name": "owner", + "description": "The account owner of the repository. The name is not case sensitive.
", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + }, + { + "name": "repo", + "description": "The name of the repository. The name is not case sensitive.
", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + }, + { + "name": "alert_number", + "in": "path", + "description": "The number that identifies a Dependabot alert in its repository. You can find this at the end of the URL for a Dependabot alert within GitHub, or in number fields in the response from the GET /repos/{owner}/{repo}/dependabot/alerts operation.
Response
", + "example": { + "number": 1, + "state": "open", + "dependency": { + "package": { + "ecosystem": "pip", + "name": "ansible" + }, + "manifest_path": "path/to/requirements.txt", + "scope": "runtime" + }, + "security_advisory": { + "ghsa_id": "GHSA-8f4m-hccc-8qph", + "cve_id": "CVE-2021-20191", + "summary": "Insertion of Sensitive Information into Log File in ansible", + "description": "A flaw was found in ansible. Credentials, such as secrets, are being disclosed in console log by default and not protected by no_log feature when using those modules. An attacker can take advantage of this information to steal those credentials. The highest threat from this vulnerability is to data confidentiality.", + "severity": "medium", + "identifiers": [ + { + "type": "GHSA", + "value": "GHSA-8f4m-hccc-8qph" + }, + { + "type": "CVE", + "value": "CVE-2021-20191" + } + ], + "references": [ + { + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20191" + }, + { + "url": "https://access.redhat.com/security/cve/cve-2021-20191" + }, + { + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1916813" + } + ], + "published_at": "2021-06-01T17:38:00Z", + "updated_at": "2021-08-12T23:06:00Z", + "withdrawn_at": null, + "vulnerabilities": [ + { + "package": { + "ecosystem": "pip", + "name": "ansible" + }, + "severity": "medium", + "vulnerable_version_range": ">= 2.9.0, < 2.9.18", + "first_patched_version": { + "identifier": "2.9.18" + } + }, + { + "package": { + "ecosystem": "pip", + "name": "ansible" + }, + "severity": "medium", + "vulnerable_version_range": "< 2.8.19", + "first_patched_version": { + "identifier": "2.8.19" + } + }, + { + "package": { + "ecosystem": "pip", + "name": "ansible" + }, + "severity": "medium", + "vulnerable_version_range": ">= 2.10.0, < 2.10.7", + "first_patched_version": { + "identifier": "2.10.7" + } + } + ], + "cvss": { + "vector_string": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", + "score": 5.5 + }, + "cwes": [ + { + "cwe_id": "CWE-532", + "name": "Insertion of Sensitive Information into Log File" + } + ] + }, + "security_vulnerability": { + "package": { + "ecosystem": "pip", + "name": "ansible" + }, + "severity": "medium", + "vulnerable_version_range": "< 2.8.19", + "first_patched_version": { + "identifier": "2.8.19" + } + }, + "url": "https://api.github.com/repos/octocat/hello-world/dependabot/alerts/1", + "html_url": "https://github.com/octocat/hello-world/security/dependabot/1", + "created_at": "2022-06-14T15:21:52Z", + "updated_at": "2022-06-14T15:21:52Z", + "dismissed_at": null, + "dismissed_by": null, + "dismissed_reason": null, + "dismissed_comment": null, + "fixed_at": null + }, + "schema": { + "type": "object", + "properties": { + "number": { + "type": "integer", + "description": "The security alert number.", + "readOnly": true + }, + "state": { + "type": "string", + "description": "State of a Dependabot alert.", + "enum": [ + "dismissed", + "fixed", + "open" + ] + }, + "dependency": { + "type": "object", + "readOnly": true, + "properties": { + "package": { + "type": "object", + "description": "The details of the vulnerable package.", + "readOnly": true, + "properties": { + "ecosystem": { + "type": "string" + }, + "name": { + "type": "string" + } + } + }, + "manifest_path": { + "type": "string", + "description": "The path to the manifest filename.", + "readOnly": true + }, + "scope": { + "type": [ + "string", + "null" + ], + "description": "The scope of the vulnerable dependency.", + "readOnly": true, + "enum": [ + "development", + "runtime", + null + ] + } + } + }, + "security_advisory": { + "type": "object", + "description": "The details of the security advisory, including summary, description, and severity.", + "readOnly": true, + "properties": { + "ghsa_id": { + "type": "string" + }, + "cve_id": { + "type": [ + "string", + "null" + ] + }, + "summary": { + "type": "string" + }, + "description": { + "type": "string" + }, + "severity": { + "type": "string", + "enum": [ + "low", + "medium", + "high", + "critical" + ] + }, + "identifiers": { + "type": "array", + "items": { + "type": "object", + "properties": { + "type": { + "type": "string", + "enum": [ + "GHSA", + "CVE" + ] + }, + "value": { + "type": "string" + } + }, + "required": [ + "value", + "type" + ], + "additionalProperties": false + } + }, + "references": { + "type": "array", + "items": { + "type": "object", + "properties": { + "url": { + "type": "string", + "format": "uri" + } + }, + "required": [ + "url" + ], + "additionalProperties": false + } + }, + "cvss": { + "type": "object", + "properties": { + "score": { + "type": "number" + }, + "vector_string": { + "type": [ + "string", + "null" + ] + } + }, + "required": [ + "vector_string", + "score" + ], + "additionalProperties": false + }, + "cwes": { + "type": "array", + "items": { + "type": "object", + "properties": { + "cwe_id": { + "type": "string" + }, + "name": { + "type": "string" + } + }, + "required": [ + "cwe_id", + "name" + ], + "additionalProperties": false + } + }, + "published_at": { + "type": "string", + "format": "date-time" + }, + "updated_at": { + "type": "string", + "format": "date-time" + }, + "vulnerabilities": { + "type": "array", + "items": { + "type": "object", + "properties": { + "first_patched_version": { + "type": [ + "object", + "null" + ], + "properties": { + "identifier": { + "type": "string" + } + }, + "required": [ + "identifier" + ], + "additionalProperties": false + }, + "package": { + "type": "object", + "properties": { + "ecosystem": { + "type": "string" + }, + "name": { + "type": "string" + } + }, + "required": [ + "ecosystem", + "name" + ], + "additionalProperties": false + }, + "severity": { + "type": "string" + }, + "vulnerable_version_range": { + "type": "string" + } + }, + "required": [ + "package", + "severity", + "vulnerable_version_range", + "first_patched_version" + ], + "additionalProperties": false + } + }, + "withdrawn_at": { + "type": [ + "string", + "null" + ], + "format": "date-time" + } + }, + "required": [ + "cvss", + "cwes", + "ghsa_id", + "summary", + "description", + "severity", + "identifiers", + "references", + "published_at", + "updated_at", + "withdrawn_at", + "vulnerabilities" + ], + "additionalProperties": false + }, + "security_vulnerability": { + "type": "object", + "description": "The details of the vulnerability of a security advisory.", + "readOnly": true, + "properties": { + "package": { + "type": "object", + "description": "The details of the vulnerable package.", + "readOnly": true, + "properties": { + "ecosystem": { + "type": "string" + }, + "name": { + "type": "string" + } + } + }, + "severity": { + "type": "string" + }, + "vulnerable_version_range": { + "type": "string" + }, + "first_patched_version": { + "type": "object", + "properties": { + "identifier": { + "type": "string" + } + } + } + } + }, + "created_at": { + "type": "string", + "description": "The time that the alert was created in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.", + "format": "date-time", + "readOnly": true + }, + "updated_at": { + "type": "string", + "description": "The time that the alert was last updated in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.", + "format": "date-time", + "readOnly": true + }, + "url": { + "type": "string", + "description": "The REST API URL of the alert resource.", + "format": "uri", + "readOnly": true + }, + "html_url": { + "type": "string", + "description": "The GitHub URL of the alert resource.", + "format": "uri", + "readOnly": true + }, + "dismissed_at": { + "type": [ + "string", + "null" + ], + "description": "The time that the alert was dismissed in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.", + "format": "date-time", + "readOnly": true + }, + "dismissed_by": { + "anyOf": [ + { + "type": "null" + }, + { + "title": "Simple User", + "description": "Simple User", + "type": "object", + "properties": { + "name": { + "type": [ + "string", + "null" + ] + }, + "email": { + "type": [ + "string", + "null" + ] + }, + "login": { + "type": "string", + "examples": [ + "octocat" + ] + }, + "id": { + "type": "integer", + "examples": [ + 1 + ] + }, + "node_id": { + "type": "string", + "examples": [ + "MDQ6VXNlcjE=" + ] + }, + "avatar_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://github.com/images/error/octocat_happy.gif" + ] + }, + "gravatar_id": { + "type": [ + "string", + "null" + ], + "examples": [ + "41d064eb2195891e12d0413f63227ea7" + ] + }, + "url": { + "type": "string", + "format": "uri", + "examples": [ + "https://api.github.com/users/octocat" + ] + }, + "html_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://github.com/octocat" + ] + }, + "followers_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://api.github.com/users/octocat/followers" + ] + }, + "following_url": { + "type": "string", + "examples": [ + "https://api.github.com/users/octocat/following{/other_user}" + ] + }, + "gists_url": { + "type": "string", + "examples": [ + "https://api.github.com/users/octocat/gists{/gist_id}" + ] + }, + "starred_url": { + "type": "string", + "examples": [ + "https://api.github.com/users/octocat/starred{/owner}{/repo}" + ] + }, + "subscriptions_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://api.github.com/users/octocat/subscriptions" + ] + }, + "organizations_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://api.github.com/users/octocat/orgs" + ] + }, + "repos_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://api.github.com/users/octocat/repos" + ] + }, + "events_url": { + "type": "string", + "examples": [ + "https://api.github.com/users/octocat/events{/privacy}" + ] + }, + "received_events_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://api.github.com/users/octocat/received_events" + ] + }, + "type": { + "type": "string", + "examples": [ + "User" + ] + }, + "site_admin": { + "type": "boolean" + }, + "starred_at": { + "type": "string", + "examples": [ + "\"2020-07-09T00:17:55Z\"" + ] + } + }, + "required": [ + "avatar_url", + "events_url", + "followers_url", + "following_url", + "gists_url", + "gravatar_id", + "html_url", + "id", + "node_id", + "login", + "organizations_url", + "received_events_url", + "repos_url", + "site_admin", + "starred_url", + "subscriptions_url", + "type", + "url" + ] + } + ] + }, + "dismissed_reason": { + "type": [ + "string", + "null" + ], + "description": "**Required when the `state` is `dismissed`.** The reason for dismissing the Dependabot alert.", + "enum": [ + "fix_started", + "inaccurate", + "no_bandwidth", + "not_used", + "tolerable_risk", + null + ] + }, + "dismissed_comment": { + "type": [ + "string", + "null" + ], + "description": "An optional comment associated with the alert's dismissal. The maximum size is 280 characters.", + "maxLength": 280 + }, + "fixed_at": { + "type": [ + "string", + "null" + ], + "description": "The time that the alert was no longer detected and was considered fixed in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.", + "format": "date-time", + "readOnly": true + } + }, + "required": [ + "number", + "state", + "dependency", + "security_advisory", + "security_vulnerability", + "url", + "html_url", + "dismissed_at", + "dismissed_by", + "dismissed_reason", + "dismissed_comment", + "fixed_at", + "created_at", + "updated_at" + ] + } + } + } + ], + "previews": [], + "descriptionHTML": "You must use an access token with the security_events scope to use this endpoint with private repositories.\nYou can also use tokens with the public_repo scope for public repositories only.\nGitHub Apps must have Dependabot alerts read permission to use this endpoint.
OK
" + }, + { + "httpStatusCode": "304", + "description": "Not modified
" + }, + { + "httpStatusCode": "403", + "description": "Forbidden
" + }, + { + "httpStatusCode": "404", + "description": "Resource not found
" + } + ] + }, + { + "serverUrl": "https://api.github.com", + "verb": "patch", + "requestPath": "/repos/{owner}/{repo}/dependabot/alerts/{alert_number}", + "title": "Update a Dependabot alert", + "category": "dependabot", + "subcategory": "alerts", + "parameters": [ + { + "name": "owner", + "description": "The account owner of the repository. The name is not case sensitive.
", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + }, + { + "name": "repo", + "description": "The name of the repository. The name is not case sensitive.
", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + }, + { + "name": "alert_number", + "in": "path", + "description": "The number that identifies a Dependabot alert in its repository. You can find this at the end of the URL for a Dependabot alert within GitHub, or in number fields in the response from the GET /repos/{owner}/{repo}/dependabot/alerts operation.
Sets the status of the dependabot alert. You must provide dismissed_reason when you set the state to dismissed.
Required when the state is dismissed. The reason for dismissing the Dependabot alert.
An optional comment associated with the alert's dismissal. The maximum size is 280 characters.
" + } + ], + "enabledForGitHubApps": true, + "codeExamples": [ + { + "key": "default", + "request": { + "contentType": "application/json", + "description": "Example", + "acceptHeader": "application/vnd.github.v3+json", + "bodyParameters": { + "state": "dismissed", + "dismissed_reason": "tolerable_risk", + "dismissed_comment": "This alert is accurate but we use a sanitizer." + }, + "parameters": { + "owner": "OWNER", + "repo": "REPO", + "alert_number": "ALERT_NUMBER" + } + }, + "response": { + "statusCode": "200", + "contentType": "application/json", + "description": "Response
", + "example": { + "number": 2, + "state": "dismissed", + "dependency": { + "package": { + "ecosystem": "pip", + "name": "django" + }, + "manifest_path": "path/to/requirements.txt", + "scope": "runtime" + }, + "security_advisory": { + "ghsa_id": "GHSA-rf4j-j272-fj86", + "cve_id": "CVE-2018-6188", + "summary": "Django allows remote attackers to obtain potentially sensitive information by leveraging data exposure from the confirm_login_allowed() method, as demonstrated by discovering whether a user account is inactive", + "description": "django.contrib.auth.forms.AuthenticationForm in Django 2.0 before 2.0.2, and 1.11.8 and 1.11.9, allows remote attackers to obtain potentially sensitive information by leveraging data exposure from the confirm_login_allowed() method, as demonstrated by discovering whether a user account is inactive.", + "severity": "high", + "identifiers": [ + { + "type": "GHSA", + "value": "GHSA-rf4j-j272-fj86" + }, + { + "type": "CVE", + "value": "CVE-2018-6188" + } + ], + "references": [ + { + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-6188" + }, + { + "url": "https://github.com/advisories/GHSA-rf4j-j272-fj86" + }, + { + "url": "https://usn.ubuntu.com/3559-1/" + }, + { + "url": "https://www.djangoproject.com/weblog/2018/feb/01/security-releases/" + }, + { + "url": "http://www.securitytracker.com/id/1040422" + } + ], + "published_at": "2018-10-03T21:13:54Z", + "updated_at": "2022-04-26T18:35:37Z", + "withdrawn_at": null, + "vulnerabilities": [ + { + "package": { + "ecosystem": "pip", + "name": "django" + }, + "severity": "high", + "vulnerable_version_range": ">= 2.0.0, < 2.0.2", + "first_patched_version": { + "identifier": "2.0.2" + } + }, + { + "package": { + "ecosystem": "pip", + "name": "django" + }, + "severity": "high", + "vulnerable_version_range": ">= 1.11.8, < 1.11.10", + "first_patched_version": { + "identifier": "1.11.10" + } + } + ], + "cvss": { + "vector_string": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", + "score": 7.5 + }, + "cwes": [ + { + "cwe_id": "CWE-200", + "name": "Exposure of Sensitive Information to an Unauthorized Actor" + } + ] + }, + "security_vulnerability": { + "package": { + "ecosystem": "pip", + "name": "django" + }, + "severity": "high", + "vulnerable_version_range": ">= 2.0.0, < 2.0.2", + "first_patched_version": { + "identifier": "2.0.2" + } + }, + "url": "https://api.github.com/repos/octocat/hello-world/dependabot/alerts/2", + "html_url": "https://github.com/octocat/hello-world/security/dependabot/2", + "created_at": "2022-06-15T07:43:03Z", + "updated_at": "2022-08-23T14:29:47Z", + "dismissed_at": "2022-08-23T14:29:47Z", + "dismissed_by": { + "login": "octocat", + "id": 1, + "node_id": "MDQ6VXNlcjE=", + "avatar_url": "https://github.com/images/error/octocat_happy.gif", + "gravatar_id": "", + "url": "https://api.github.com/users/octocat", + "html_url": "https://github.com/octocat", + "followers_url": "https://api.github.com/users/octocat/followers", + "following_url": "https://api.github.com/users/octocat/following{/other_user}", + "gists_url": "https://api.github.com/users/octocat/gists{/gist_id}", + "starred_url": "https://api.github.com/users/octocat/starred{/owner}{/repo}", + "subscriptions_url": "https://api.github.com/users/octocat/subscriptions", + "organizations_url": "https://api.github.com/users/octocat/orgs", + "repos_url": "https://api.github.com/users/octocat/repos", + "events_url": "https://api.github.com/users/octocat/events{/privacy}", + "received_events_url": "https://api.github.com/users/octocat/received_events", + "type": "User", + "site_admin": false + }, + "dismissed_reason": "tolerable_risk", + "dismissed_comment": "This alert is accurate but we use a sanitizer.", + "fixed_at": null + }, + "schema": { + "type": "object", + "properties": { + "number": { + "type": "integer", + "description": "The security alert number.", + "readOnly": true + }, + "state": { + "type": "string", + "description": "State of a Dependabot alert.", + "enum": [ + "dismissed", + "fixed", + "open" + ] + }, + "dependency": { + "type": "object", + "readOnly": true, + "properties": { + "package": { + "type": "object", + "description": "The details of the vulnerable package.", + "readOnly": true, + "properties": { + "ecosystem": { + "type": "string" + }, + "name": { + "type": "string" + } + } + }, + "manifest_path": { + "type": "string", + "description": "The path to the manifest filename.", + "readOnly": true + }, + "scope": { + "type": [ + "string", + "null" + ], + "description": "The scope of the vulnerable dependency.", + "readOnly": true, + "enum": [ + "development", + "runtime", + null + ] + } + } + }, + "security_advisory": { + "type": "object", + "description": "The details of the security advisory, including summary, description, and severity.", + "readOnly": true, + "properties": { + "ghsa_id": { + "type": "string" + }, + "cve_id": { + "type": [ + "string", + "null" + ] + }, + "summary": { + "type": "string" + }, + "description": { + "type": "string" + }, + "severity": { + "type": "string", + "enum": [ + "low", + "medium", + "high", + "critical" + ] + }, + "identifiers": { + "type": "array", + "items": { + "type": "object", + "properties": { + "type": { + "type": "string", + "enum": [ + "GHSA", + "CVE" + ] + }, + "value": { + "type": "string" + } + }, + "required": [ + "value", + "type" + ], + "additionalProperties": false + } + }, + "references": { + "type": "array", + "items": { + "type": "object", + "properties": { + "url": { + "type": "string", + "format": "uri" + } + }, + "required": [ + "url" + ], + "additionalProperties": false + } + }, + "cvss": { + "type": "object", + "properties": { + "score": { + "type": "number" + }, + "vector_string": { + "type": [ + "string", + "null" + ] + } + }, + "required": [ + "vector_string", + "score" + ], + "additionalProperties": false + }, + "cwes": { + "type": "array", + "items": { + "type": "object", + "properties": { + "cwe_id": { + "type": "string" + }, + "name": { + "type": "string" + } + }, + "required": [ + "cwe_id", + "name" + ], + "additionalProperties": false + } + }, + "published_at": { + "type": "string", + "format": "date-time" + }, + "updated_at": { + "type": "string", + "format": "date-time" + }, + "vulnerabilities": { + "type": "array", + "items": { + "type": "object", + "properties": { + "first_patched_version": { + "type": [ + "object", + "null" + ], + "properties": { + "identifier": { + "type": "string" + } + }, + "required": [ + "identifier" + ], + "additionalProperties": false + }, + "package": { + "type": "object", + "properties": { + "ecosystem": { + "type": "string" + }, + "name": { + "type": "string" + } + }, + "required": [ + "ecosystem", + "name" + ], + "additionalProperties": false + }, + "severity": { + "type": "string" + }, + "vulnerable_version_range": { + "type": "string" + } + }, + "required": [ + "package", + "severity", + "vulnerable_version_range", + "first_patched_version" + ], + "additionalProperties": false + } + }, + "withdrawn_at": { + "type": [ + "string", + "null" + ], + "format": "date-time" + } + }, + "required": [ + "cvss", + "cwes", + "ghsa_id", + "summary", + "description", + "severity", + "identifiers", + "references", + "published_at", + "updated_at", + "withdrawn_at", + "vulnerabilities" + ], + "additionalProperties": false + }, + "security_vulnerability": { + "type": "object", + "description": "The details of the vulnerability of a security advisory.", + "readOnly": true, + "properties": { + "package": { + "type": "object", + "description": "The details of the vulnerable package.", + "readOnly": true, + "properties": { + "ecosystem": { + "type": "string" + }, + "name": { + "type": "string" + } + } + }, + "severity": { + "type": "string" + }, + "vulnerable_version_range": { + "type": "string" + }, + "first_patched_version": { + "type": "object", + "properties": { + "identifier": { + "type": "string" + } + } + } + } + }, + "created_at": { + "type": "string", + "description": "The time that the alert was created in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.", + "format": "date-time", + "readOnly": true + }, + "updated_at": { + "type": "string", + "description": "The time that the alert was last updated in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.", + "format": "date-time", + "readOnly": true + }, + "url": { + "type": "string", + "description": "The REST API URL of the alert resource.", + "format": "uri", + "readOnly": true + }, + "html_url": { + "type": "string", + "description": "The GitHub URL of the alert resource.", + "format": "uri", + "readOnly": true + }, + "dismissed_at": { + "type": [ + "string", + "null" + ], + "description": "The time that the alert was dismissed in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.", + "format": "date-time", + "readOnly": true + }, + "dismissed_by": { + "anyOf": [ + { + "type": "null" + }, + { + "title": "Simple User", + "description": "Simple User", + "type": "object", + "properties": { + "name": { + "type": [ + "string", + "null" + ] + }, + "email": { + "type": [ + "string", + "null" + ] + }, + "login": { + "type": "string", + "examples": [ + "octocat" + ] + }, + "id": { + "type": "integer", + "examples": [ + 1 + ] + }, + "node_id": { + "type": "string", + "examples": [ + "MDQ6VXNlcjE=" + ] + }, + "avatar_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://github.com/images/error/octocat_happy.gif" + ] + }, + "gravatar_id": { + "type": [ + "string", + "null" + ], + "examples": [ + "41d064eb2195891e12d0413f63227ea7" + ] + }, + "url": { + "type": "string", + "format": "uri", + "examples": [ + "https://api.github.com/users/octocat" + ] + }, + "html_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://github.com/octocat" + ] + }, + "followers_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://api.github.com/users/octocat/followers" + ] + }, + "following_url": { + "type": "string", + "examples": [ + "https://api.github.com/users/octocat/following{/other_user}" + ] + }, + "gists_url": { + "type": "string", + "examples": [ + "https://api.github.com/users/octocat/gists{/gist_id}" + ] + }, + "starred_url": { + "type": "string", + "examples": [ + "https://api.github.com/users/octocat/starred{/owner}{/repo}" + ] + }, + "subscriptions_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://api.github.com/users/octocat/subscriptions" + ] + }, + "organizations_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://api.github.com/users/octocat/orgs" + ] + }, + "repos_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://api.github.com/users/octocat/repos" + ] + }, + "events_url": { + "type": "string", + "examples": [ + "https://api.github.com/users/octocat/events{/privacy}" + ] + }, + "received_events_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://api.github.com/users/octocat/received_events" + ] + }, + "type": { + "type": "string", + "examples": [ + "User" + ] + }, + "site_admin": { + "type": "boolean" + }, + "starred_at": { + "type": "string", + "examples": [ + "\"2020-07-09T00:17:55Z\"" + ] + } + }, + "required": [ + "avatar_url", + "events_url", + "followers_url", + "following_url", + "gists_url", + "gravatar_id", + "html_url", + "id", + "node_id", + "login", + "organizations_url", + "received_events_url", + "repos_url", + "site_admin", + "starred_url", + "subscriptions_url", + "type", + "url" + ] + } + ] + }, + "dismissed_reason": { + "type": [ + "string", + "null" + ], + "description": "**Required when the `state` is `dismissed`.** The reason for dismissing the Dependabot alert.", + "enum": [ + "fix_started", + "inaccurate", + "no_bandwidth", + "not_used", + "tolerable_risk", + null + ] + }, + "dismissed_comment": { + "type": [ + "string", + "null" + ], + "description": "An optional comment associated with the alert's dismissal. The maximum size is 280 characters.", + "maxLength": 280 + }, + "fixed_at": { + "type": [ + "string", + "null" + ], + "description": "The time that the alert was no longer detected and was considered fixed in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.", + "format": "date-time", + "readOnly": true + } + }, + "required": [ + "number", + "state", + "dependency", + "security_advisory", + "security_vulnerability", + "url", + "html_url", + "dismissed_at", + "dismissed_by", + "dismissed_reason", + "dismissed_comment", + "fixed_at", + "created_at", + "updated_at" + ] + } + } + } + ], + "previews": [], + "descriptionHTML": "You must use an access token with the security_events scope to use this endpoint with private repositories.\nYou can also use tokens with the public_repo scope for public repositories only.\nGitHub Apps must have Dependabot alerts write permission to use this endpoint.
OK
" + }, + { + "httpStatusCode": "304", + "description": "Not modified
" + }, + { + "httpStatusCode": "400", + "description": "Bad Request
" + }, + { + "httpStatusCode": "403", + "description": "Forbidden
" + }, + { + "httpStatusCode": "404", + "description": "Resource not found
" + }, + { + "httpStatusCode": "409", + "description": "Conflict
" + }, + { + "httpStatusCode": "422", + "description": "Validation failed
" + } + ] + } + ], "secrets": [ { "serverUrl": "https://api.github.com", diff --git a/lib/rest/static/decorated/ghec.json b/lib/rest/static/decorated/ghec.json index 29a0a8dfd2..69116ddd04 100644 --- a/lib/rest/static/decorated/ghec.json +++ b/lib/rest/static/decorated/ghec.json @@ -266890,6 +266890,2446 @@ ] }, "dependabot": { + "alerts": [ + { + "serverUrl": "https://api.github.com", + "verb": "get", + "requestPath": "/repos/{owner}/{repo}/dependabot/alerts", + "title": "List Dependabot alerts for a repository", + "category": "dependabot", + "subcategory": "alerts", + "parameters": [ + { + "name": "owner", + "description": "The account owner of the repository. The name is not case sensitive.
", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + }, + { + "name": "repo", + "description": "The name of the repository. The name is not case sensitive.
", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + }, + { + "name": "state", + "description": "A comma-separated list of states. If specified, only alerts with these states will be returned.
\nCan be: dismissed, fixed, open
A comma-separated list of severities. If specified, only alerts with these severities will be returned.
\nCan be: low, medium, high, critical
A comma-separated list of ecosystems. If specified, only alerts for these ecosystems will be returned.
\nCan be: composer, go, maven, npm, nuget, pip, rubygems, rust
A comma-separated list of package names. If specified, only alerts for these packages will be returned.
", + "in": "query", + "schema": { + "type": "string" + } + }, + { + "name": "manifest", + "description": "A comma-separated list of full manifest paths. If specified, only alerts for these manifests will be returned.
", + "in": "query", + "schema": { + "type": "string" + } + }, + { + "name": "scope", + "description": "Scope of the dependency on a Dependabot alert.
", + "in": "query", + "schema": { + "type": [ + "string", + "null" + ], + "description": "The scope of the vulnerable dependency.", + "readOnly": true, + "enum": [ + "development", + "runtime", + null + ] + } + }, + { + "name": "sort", + "description": "The property by which to sort the results.\ncreated means when the alert was created.\nupdated means when the alert's state last changed.
The direction to sort the results by.
", + "in": "query", + "required": false, + "schema": { + "type": "string", + "enum": [ + "asc", + "desc" + ], + "default": "desc" + } + }, + { + "name": "page", + "description": "Page number of the results to fetch.
", + "in": "query", + "schema": { + "type": "integer", + "default": 1 + } + }, + { + "name": "per_page", + "description": "The number of results per page (max 100).
", + "in": "query", + "schema": { + "type": "integer", + "default": 30 + } + } + ], + "bodyParameters": [], + "enabledForGitHubApps": true, + "codeExamples": [ + { + "key": "default", + "request": { + "description": "Example", + "acceptHeader": "application/vnd.github.v3+json", + "parameters": { + "owner": "OWNER", + "repo": "REPO" + } + }, + "response": { + "statusCode": "200", + "contentType": "application/json", + "description": "Response
", + "example": [ + { + "number": 2, + "state": "dismissed", + "dependency": { + "package": { + "ecosystem": "pip", + "name": "django" + }, + "manifest_path": "path/to/requirements.txt", + "scope": "runtime" + }, + "security_advisory": { + "ghsa_id": "GHSA-rf4j-j272-fj86", + "cve_id": "CVE-2018-6188", + "summary": "Django allows remote attackers to obtain potentially sensitive information by leveraging data exposure from the confirm_login_allowed() method, as demonstrated by discovering whether a user account is inactive", + "description": "django.contrib.auth.forms.AuthenticationForm in Django 2.0 before 2.0.2, and 1.11.8 and 1.11.9, allows remote attackers to obtain potentially sensitive information by leveraging data exposure from the confirm_login_allowed() method, as demonstrated by discovering whether a user account is inactive.", + "severity": "high", + "identifiers": [ + { + "type": "GHSA", + "value": "GHSA-rf4j-j272-fj86" + }, + { + "type": "CVE", + "value": "CVE-2018-6188" + } + ], + "references": [ + { + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-6188" + }, + { + "url": "https://github.com/advisories/GHSA-rf4j-j272-fj86" + }, + { + "url": "https://usn.ubuntu.com/3559-1/" + }, + { + "url": "https://www.djangoproject.com/weblog/2018/feb/01/security-releases/" + }, + { + "url": "http://www.securitytracker.com/id/1040422" + } + ], + "published_at": "2018-10-03T21:13:54Z", + "updated_at": "2022-04-26T18:35:37Z", + "withdrawn_at": null, + "vulnerabilities": [ + { + "package": { + "ecosystem": "pip", + "name": "django" + }, + "severity": "high", + "vulnerable_version_range": ">= 2.0.0, < 2.0.2", + "first_patched_version": { + "identifier": "2.0.2" + } + }, + { + "package": { + "ecosystem": "pip", + "name": "django" + }, + "severity": "high", + "vulnerable_version_range": ">= 1.11.8, < 1.11.10", + "first_patched_version": { + "identifier": "1.11.10" + } + } + ], + "cvss": { + "vector_string": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", + "score": 7.5 + }, + "cwes": [ + { + "cwe_id": "CWE-200", + "name": "Exposure of Sensitive Information to an Unauthorized Actor" + } + ] + }, + "security_vulnerability": { + "package": { + "ecosystem": "pip", + "name": "django" + }, + "severity": "high", + "vulnerable_version_range": ">= 2.0.0, < 2.0.2", + "first_patched_version": { + "identifier": "2.0.2" + } + }, + "url": "https://api.github.com/repos/octocat/hello-world/dependabot/alerts/2", + "html_url": "https://github.com/octocat/hello-world/security/dependabot/2", + "created_at": "2022-06-15T07:43:03Z", + "updated_at": "2022-08-23T14:29:47Z", + "dismissed_at": "2022-08-23T14:29:47Z", + "dismissed_by": { + "login": "octocat", + "id": 1, + "node_id": "MDQ6VXNlcjE=", + "avatar_url": "https://github.com/images/error/octocat_happy.gif", + "gravatar_id": "", + "url": "https://api.github.com/users/octocat", + "html_url": "https://github.com/octocat", + "followers_url": "https://api.github.com/users/octocat/followers", + "following_url": "https://api.github.com/users/octocat/following{/other_user}", + "gists_url": "https://api.github.com/users/octocat/gists{/gist_id}", + "starred_url": "https://api.github.com/users/octocat/starred{/owner}{/repo}", + "subscriptions_url": "https://api.github.com/users/octocat/subscriptions", + "organizations_url": "https://api.github.com/users/octocat/orgs", + "repos_url": "https://api.github.com/users/octocat/repos", + "events_url": "https://api.github.com/users/octocat/events{/privacy}", + "received_events_url": "https://api.github.com/users/octocat/received_events", + "type": "User", + "site_admin": false + }, + "dismissed_reason": "tolerable_risk", + "dismissed_comment": "This alert is accurate but we use a sanitizer.", + "fixed_at": null + }, + { + "number": 1, + "state": "open", + "dependency": { + "package": { + "ecosystem": "pip", + "name": "ansible" + }, + "manifest_path": "path/to/requirements.txt", + "scope": "runtime" + }, + "security_advisory": { + "ghsa_id": "GHSA-8f4m-hccc-8qph", + "cve_id": "CVE-2021-20191", + "summary": "Insertion of Sensitive Information into Log File in ansible", + "description": "A flaw was found in ansible. Credentials, such as secrets, are being disclosed in console log by default and not protected by no_log feature when using those modules. An attacker can take advantage of this information to steal those credentials. The highest threat from this vulnerability is to data confidentiality.", + "severity": "medium", + "identifiers": [ + { + "type": "GHSA", + "value": "GHSA-8f4m-hccc-8qph" + }, + { + "type": "CVE", + "value": "CVE-2021-20191" + } + ], + "references": [ + { + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20191" + }, + { + "url": "https://access.redhat.com/security/cve/cve-2021-20191" + }, + { + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1916813" + } + ], + "published_at": "2021-06-01T17:38:00Z", + "updated_at": "2021-08-12T23:06:00Z", + "withdrawn_at": null, + "vulnerabilities": [ + { + "package": { + "ecosystem": "pip", + "name": "ansible" + }, + "severity": "medium", + "vulnerable_version_range": ">= 2.9.0, < 2.9.18", + "first_patched_version": { + "identifier": "2.9.18" + } + }, + { + "package": { + "ecosystem": "pip", + "name": "ansible" + }, + "severity": "medium", + "vulnerable_version_range": "< 2.8.19", + "first_patched_version": { + "identifier": "2.8.19" + } + }, + { + "package": { + "ecosystem": "pip", + "name": "ansible" + }, + "severity": "medium", + "vulnerable_version_range": ">= 2.10.0, < 2.10.7", + "first_patched_version": { + "identifier": "2.10.7" + } + } + ], + "cvss": { + "vector_string": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", + "score": 5.5 + }, + "cwes": [ + { + "cwe_id": "CWE-532", + "name": "Insertion of Sensitive Information into Log File" + } + ] + }, + "security_vulnerability": { + "package": { + "ecosystem": "pip", + "name": "ansible" + }, + "severity": "medium", + "vulnerable_version_range": "< 2.8.19", + "first_patched_version": { + "identifier": "2.8.19" + } + }, + "url": "https://api.github.com/repos/octocat/hello-world/dependabot/alerts/1", + "html_url": "https://github.com/octocat/hello-world/security/dependabot/1", + "created_at": "2022-06-14T15:21:52Z", + "updated_at": "2022-06-14T15:21:52Z", + "dismissed_at": null, + "dismissed_by": null, + "dismissed_reason": null, + "dismissed_comment": null, + "fixed_at": null + } + ], + "schema": { + "type": "array", + "items": { + "type": "object", + "properties": { + "number": { + "type": "integer", + "description": "The security alert number.", + "readOnly": true + }, + "state": { + "type": "string", + "description": "State of a Dependabot alert.", + "enum": [ + "dismissed", + "fixed", + "open" + ] + }, + "dependency": { + "type": "object", + "readOnly": true, + "properties": { + "package": { + "type": "object", + "description": "The details of the vulnerable package.", + "readOnly": true, + "properties": { + "ecosystem": { + "type": "string" + }, + "name": { + "type": "string" + } + } + }, + "manifest_path": { + "type": "string", + "description": "The path to the manifest filename.", + "readOnly": true + }, + "scope": { + "type": [ + "string", + "null" + ], + "description": "The scope of the vulnerable dependency.", + "readOnly": true, + "enum": [ + "development", + "runtime", + null + ] + } + } + }, + "security_advisory": { + "type": "object", + "description": "The details of the security advisory, including summary, description, and severity.", + "readOnly": true, + "properties": { + "ghsa_id": { + "type": "string" + }, + "cve_id": { + "type": [ + "string", + "null" + ] + }, + "summary": { + "type": "string" + }, + "description": { + "type": "string" + }, + "severity": { + "type": "string", + "enum": [ + "low", + "medium", + "high", + "critical" + ] + }, + "identifiers": { + "type": "array", + "items": { + "type": "object", + "properties": { + "type": { + "type": "string", + "enum": [ + "GHSA", + "CVE" + ] + }, + "value": { + "type": "string" + } + }, + "required": [ + "value", + "type" + ], + "additionalProperties": false + } + }, + "references": { + "type": "array", + "items": { + "type": "object", + "properties": { + "url": { + "type": "string", + "format": "uri" + } + }, + "required": [ + "url" + ], + "additionalProperties": false + } + }, + "cvss": { + "type": "object", + "properties": { + "score": { + "type": "number" + }, + "vector_string": { + "type": [ + "string", + "null" + ] + } + }, + "required": [ + "vector_string", + "score" + ], + "additionalProperties": false + }, + "cwes": { + "type": "array", + "items": { + "type": "object", + "properties": { + "cwe_id": { + "type": "string" + }, + "name": { + "type": "string" + } + }, + "required": [ + "cwe_id", + "name" + ], + "additionalProperties": false + } + }, + "published_at": { + "type": "string", + "format": "date-time" + }, + "updated_at": { + "type": "string", + "format": "date-time" + }, + "vulnerabilities": { + "type": "array", + "items": { + "type": "object", + "properties": { + "first_patched_version": { + "type": [ + "object", + "null" + ], + "properties": { + "identifier": { + "type": "string" + } + }, + "required": [ + "identifier" + ], + "additionalProperties": false + }, + "package": { + "type": "object", + "properties": { + "ecosystem": { + "type": "string" + }, + "name": { + "type": "string" + } + }, + "required": [ + "ecosystem", + "name" + ], + "additionalProperties": false + }, + "severity": { + "type": "string" + }, + "vulnerable_version_range": { + "type": "string" + } + }, + "required": [ + "package", + "severity", + "vulnerable_version_range", + "first_patched_version" + ], + "additionalProperties": false + } + }, + "withdrawn_at": { + "type": [ + "string", + "null" + ], + "format": "date-time" + } + }, + "required": [ + "cvss", + "cwes", + "ghsa_id", + "summary", + "description", + "severity", + "identifiers", + "references", + "published_at", + "updated_at", + "withdrawn_at", + "vulnerabilities" + ], + "additionalProperties": false + }, + "security_vulnerability": { + "type": "object", + "description": "The details of the vulnerability of a security advisory.", + "readOnly": true, + "properties": { + "package": { + "type": "object", + "description": "The details of the vulnerable package.", + "readOnly": true, + "properties": { + "ecosystem": { + "type": "string" + }, + "name": { + "type": "string" + } + } + }, + "severity": { + "type": "string" + }, + "vulnerable_version_range": { + "type": "string" + }, + "first_patched_version": { + "type": "object", + "properties": { + "identifier": { + "type": "string" + } + } + } + } + }, + "created_at": { + "type": "string", + "description": "The time that the alert was created in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.", + "format": "date-time", + "readOnly": true + }, + "updated_at": { + "type": "string", + "description": "The time that the alert was last updated in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.", + "format": "date-time", + "readOnly": true + }, + "url": { + "type": "string", + "description": "The REST API URL of the alert resource.", + "format": "uri", + "readOnly": true + }, + "html_url": { + "type": "string", + "description": "The GitHub URL of the alert resource.", + "format": "uri", + "readOnly": true + }, + "dismissed_at": { + "type": [ + "string", + "null" + ], + "description": "The time that the alert was dismissed in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.", + "format": "date-time", + "readOnly": true + }, + "dismissed_by": { + "anyOf": [ + { + "type": "null" + }, + { + "title": "Simple User", + "description": "Simple User", + "type": "object", + "properties": { + "name": { + "type": [ + "string", + "null" + ] + }, + "email": { + "type": [ + "string", + "null" + ] + }, + "login": { + "type": "string", + "examples": [ + "octocat" + ] + }, + "id": { + "type": "integer", + "examples": [ + 1 + ] + }, + "node_id": { + "type": "string", + "examples": [ + "MDQ6VXNlcjE=" + ] + }, + "avatar_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://github.com/images/error/octocat_happy.gif" + ] + }, + "gravatar_id": { + "type": [ + "string", + "null" + ], + "examples": [ + "41d064eb2195891e12d0413f63227ea7" + ] + }, + "url": { + "type": "string", + "format": "uri", + "examples": [ + "https://api.github.com/users/octocat" + ] + }, + "html_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://github.com/octocat" + ] + }, + "followers_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://api.github.com/users/octocat/followers" + ] + }, + "following_url": { + "type": "string", + "examples": [ + "https://api.github.com/users/octocat/following{/other_user}" + ] + }, + "gists_url": { + "type": "string", + "examples": [ + "https://api.github.com/users/octocat/gists{/gist_id}" + ] + }, + "starred_url": { + "type": "string", + "examples": [ + "https://api.github.com/users/octocat/starred{/owner}{/repo}" + ] + }, + "subscriptions_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://api.github.com/users/octocat/subscriptions" + ] + }, + "organizations_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://api.github.com/users/octocat/orgs" + ] + }, + "repos_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://api.github.com/users/octocat/repos" + ] + }, + "events_url": { + "type": "string", + "examples": [ + "https://api.github.com/users/octocat/events{/privacy}" + ] + }, + "received_events_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://api.github.com/users/octocat/received_events" + ] + }, + "type": { + "type": "string", + "examples": [ + "User" + ] + }, + "site_admin": { + "type": "boolean" + }, + "starred_at": { + "type": "string", + "examples": [ + "\"2020-07-09T00:17:55Z\"" + ] + } + }, + "required": [ + "avatar_url", + "events_url", + "followers_url", + "following_url", + "gists_url", + "gravatar_id", + "html_url", + "id", + "node_id", + "login", + "organizations_url", + "received_events_url", + "repos_url", + "site_admin", + "starred_url", + "subscriptions_url", + "type", + "url" + ] + } + ] + }, + "dismissed_reason": { + "type": [ + "string", + "null" + ], + "description": "**Required when the `state` is `dismissed`.** The reason for dismissing the Dependabot alert.", + "enum": [ + "fix_started", + "inaccurate", + "no_bandwidth", + "not_used", + "tolerable_risk", + null + ] + }, + "dismissed_comment": { + "type": [ + "string", + "null" + ], + "description": "An optional comment associated with the alert's dismissal. The maximum size is 280 characters.", + "maxLength": 280 + }, + "fixed_at": { + "type": [ + "string", + "null" + ], + "description": "The time that the alert was no longer detected and was considered fixed in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.", + "format": "date-time", + "readOnly": true + } + }, + "required": [ + "number", + "state", + "dependency", + "security_advisory", + "security_vulnerability", + "url", + "html_url", + "dismissed_at", + "dismissed_by", + "dismissed_reason", + "dismissed_comment", + "fixed_at", + "created_at", + "updated_at" + ] + } + } + } + } + ], + "previews": [], + "descriptionHTML": "You must use an access token with the security_events scope to use this endpoint with private repositories.\nYou can also use tokens with the public_repo scope for public repositories only.\nGitHub Apps must have Dependabot alerts read permission to use this endpoint.
OK
" + }, + { + "httpStatusCode": "304", + "description": "Not modified
" + }, + { + "httpStatusCode": "403", + "description": "Forbidden
" + }, + { + "httpStatusCode": "404", + "description": "Resource not found
" + }, + { + "httpStatusCode": "422", + "description": "Validation failed
" + } + ] + }, + { + "serverUrl": "https://api.github.com", + "verb": "get", + "requestPath": "/repos/{owner}/{repo}/dependabot/alerts/{alert_number}", + "title": "Get a Dependabot alert", + "category": "dependabot", + "subcategory": "alerts", + "parameters": [ + { + "name": "owner", + "description": "The account owner of the repository. The name is not case sensitive.
", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + }, + { + "name": "repo", + "description": "The name of the repository. The name is not case sensitive.
", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + }, + { + "name": "alert_number", + "in": "path", + "description": "The number that identifies a Dependabot alert in its repository. You can find this at the end of the URL for a Dependabot alert within GitHub, or in number fields in the response from the GET /repos/{owner}/{repo}/dependabot/alerts operation.
Response
", + "example": { + "number": 1, + "state": "open", + "dependency": { + "package": { + "ecosystem": "pip", + "name": "ansible" + }, + "manifest_path": "path/to/requirements.txt", + "scope": "runtime" + }, + "security_advisory": { + "ghsa_id": "GHSA-8f4m-hccc-8qph", + "cve_id": "CVE-2021-20191", + "summary": "Insertion of Sensitive Information into Log File in ansible", + "description": "A flaw was found in ansible. Credentials, such as secrets, are being disclosed in console log by default and not protected by no_log feature when using those modules. An attacker can take advantage of this information to steal those credentials. The highest threat from this vulnerability is to data confidentiality.", + "severity": "medium", + "identifiers": [ + { + "type": "GHSA", + "value": "GHSA-8f4m-hccc-8qph" + }, + { + "type": "CVE", + "value": "CVE-2021-20191" + } + ], + "references": [ + { + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20191" + }, + { + "url": "https://access.redhat.com/security/cve/cve-2021-20191" + }, + { + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1916813" + } + ], + "published_at": "2021-06-01T17:38:00Z", + "updated_at": "2021-08-12T23:06:00Z", + "withdrawn_at": null, + "vulnerabilities": [ + { + "package": { + "ecosystem": "pip", + "name": "ansible" + }, + "severity": "medium", + "vulnerable_version_range": ">= 2.9.0, < 2.9.18", + "first_patched_version": { + "identifier": "2.9.18" + } + }, + { + "package": { + "ecosystem": "pip", + "name": "ansible" + }, + "severity": "medium", + "vulnerable_version_range": "< 2.8.19", + "first_patched_version": { + "identifier": "2.8.19" + } + }, + { + "package": { + "ecosystem": "pip", + "name": "ansible" + }, + "severity": "medium", + "vulnerable_version_range": ">= 2.10.0, < 2.10.7", + "first_patched_version": { + "identifier": "2.10.7" + } + } + ], + "cvss": { + "vector_string": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", + "score": 5.5 + }, + "cwes": [ + { + "cwe_id": "CWE-532", + "name": "Insertion of Sensitive Information into Log File" + } + ] + }, + "security_vulnerability": { + "package": { + "ecosystem": "pip", + "name": "ansible" + }, + "severity": "medium", + "vulnerable_version_range": "< 2.8.19", + "first_patched_version": { + "identifier": "2.8.19" + } + }, + "url": "https://api.github.com/repos/octocat/hello-world/dependabot/alerts/1", + "html_url": "https://github.com/octocat/hello-world/security/dependabot/1", + "created_at": "2022-06-14T15:21:52Z", + "updated_at": "2022-06-14T15:21:52Z", + "dismissed_at": null, + "dismissed_by": null, + "dismissed_reason": null, + "dismissed_comment": null, + "fixed_at": null + }, + "schema": { + "type": "object", + "properties": { + "number": { + "type": "integer", + "description": "The security alert number.", + "readOnly": true + }, + "state": { + "type": "string", + "description": "State of a Dependabot alert.", + "enum": [ + "dismissed", + "fixed", + "open" + ] + }, + "dependency": { + "type": "object", + "readOnly": true, + "properties": { + "package": { + "type": "object", + "description": "The details of the vulnerable package.", + "readOnly": true, + "properties": { + "ecosystem": { + "type": "string" + }, + "name": { + "type": "string" + } + } + }, + "manifest_path": { + "type": "string", + "description": "The path to the manifest filename.", + "readOnly": true + }, + "scope": { + "type": [ + "string", + "null" + ], + "description": "The scope of the vulnerable dependency.", + "readOnly": true, + "enum": [ + "development", + "runtime", + null + ] + } + } + }, + "security_advisory": { + "type": "object", + "description": "The details of the security advisory, including summary, description, and severity.", + "readOnly": true, + "properties": { + "ghsa_id": { + "type": "string" + }, + "cve_id": { + "type": [ + "string", + "null" + ] + }, + "summary": { + "type": "string" + }, + "description": { + "type": "string" + }, + "severity": { + "type": "string", + "enum": [ + "low", + "medium", + "high", + "critical" + ] + }, + "identifiers": { + "type": "array", + "items": { + "type": "object", + "properties": { + "type": { + "type": "string", + "enum": [ + "GHSA", + "CVE" + ] + }, + "value": { + "type": "string" + } + }, + "required": [ + "value", + "type" + ], + "additionalProperties": false + } + }, + "references": { + "type": "array", + "items": { + "type": "object", + "properties": { + "url": { + "type": "string", + "format": "uri" + } + }, + "required": [ + "url" + ], + "additionalProperties": false + } + }, + "cvss": { + "type": "object", + "properties": { + "score": { + "type": "number" + }, + "vector_string": { + "type": [ + "string", + "null" + ] + } + }, + "required": [ + "vector_string", + "score" + ], + "additionalProperties": false + }, + "cwes": { + "type": "array", + "items": { + "type": "object", + "properties": { + "cwe_id": { + "type": "string" + }, + "name": { + "type": "string" + } + }, + "required": [ + "cwe_id", + "name" + ], + "additionalProperties": false + } + }, + "published_at": { + "type": "string", + "format": "date-time" + }, + "updated_at": { + "type": "string", + "format": "date-time" + }, + "vulnerabilities": { + "type": "array", + "items": { + "type": "object", + "properties": { + "first_patched_version": { + "type": [ + "object", + "null" + ], + "properties": { + "identifier": { + "type": "string" + } + }, + "required": [ + "identifier" + ], + "additionalProperties": false + }, + "package": { + "type": "object", + "properties": { + "ecosystem": { + "type": "string" + }, + "name": { + "type": "string" + } + }, + "required": [ + "ecosystem", + "name" + ], + "additionalProperties": false + }, + "severity": { + "type": "string" + }, + "vulnerable_version_range": { + "type": "string" + } + }, + "required": [ + "package", + "severity", + "vulnerable_version_range", + "first_patched_version" + ], + "additionalProperties": false + } + }, + "withdrawn_at": { + "type": [ + "string", + "null" + ], + "format": "date-time" + } + }, + "required": [ + "cvss", + "cwes", + "ghsa_id", + "summary", + "description", + "severity", + "identifiers", + "references", + "published_at", + "updated_at", + "withdrawn_at", + "vulnerabilities" + ], + "additionalProperties": false + }, + "security_vulnerability": { + "type": "object", + "description": "The details of the vulnerability of a security advisory.", + "readOnly": true, + "properties": { + "package": { + "type": "object", + "description": "The details of the vulnerable package.", + "readOnly": true, + "properties": { + "ecosystem": { + "type": "string" + }, + "name": { + "type": "string" + } + } + }, + "severity": { + "type": "string" + }, + "vulnerable_version_range": { + "type": "string" + }, + "first_patched_version": { + "type": "object", + "properties": { + "identifier": { + "type": "string" + } + } + } + } + }, + "created_at": { + "type": "string", + "description": "The time that the alert was created in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.", + "format": "date-time", + "readOnly": true + }, + "updated_at": { + "type": "string", + "description": "The time that the alert was last updated in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.", + "format": "date-time", + "readOnly": true + }, + "url": { + "type": "string", + "description": "The REST API URL of the alert resource.", + "format": "uri", + "readOnly": true + }, + "html_url": { + "type": "string", + "description": "The GitHub URL of the alert resource.", + "format": "uri", + "readOnly": true + }, + "dismissed_at": { + "type": [ + "string", + "null" + ], + "description": "The time that the alert was dismissed in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.", + "format": "date-time", + "readOnly": true + }, + "dismissed_by": { + "anyOf": [ + { + "type": "null" + }, + { + "title": "Simple User", + "description": "Simple User", + "type": "object", + "properties": { + "name": { + "type": [ + "string", + "null" + ] + }, + "email": { + "type": [ + "string", + "null" + ] + }, + "login": { + "type": "string", + "examples": [ + "octocat" + ] + }, + "id": { + "type": "integer", + "examples": [ + 1 + ] + }, + "node_id": { + "type": "string", + "examples": [ + "MDQ6VXNlcjE=" + ] + }, + "avatar_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://github.com/images/error/octocat_happy.gif" + ] + }, + "gravatar_id": { + "type": [ + "string", + "null" + ], + "examples": [ + "41d064eb2195891e12d0413f63227ea7" + ] + }, + "url": { + "type": "string", + "format": "uri", + "examples": [ + "https://api.github.com/users/octocat" + ] + }, + "html_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://github.com/octocat" + ] + }, + "followers_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://api.github.com/users/octocat/followers" + ] + }, + "following_url": { + "type": "string", + "examples": [ + "https://api.github.com/users/octocat/following{/other_user}" + ] + }, + "gists_url": { + "type": "string", + "examples": [ + "https://api.github.com/users/octocat/gists{/gist_id}" + ] + }, + "starred_url": { + "type": "string", + "examples": [ + "https://api.github.com/users/octocat/starred{/owner}{/repo}" + ] + }, + "subscriptions_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://api.github.com/users/octocat/subscriptions" + ] + }, + "organizations_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://api.github.com/users/octocat/orgs" + ] + }, + "repos_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://api.github.com/users/octocat/repos" + ] + }, + "events_url": { + "type": "string", + "examples": [ + "https://api.github.com/users/octocat/events{/privacy}" + ] + }, + "received_events_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://api.github.com/users/octocat/received_events" + ] + }, + "type": { + "type": "string", + "examples": [ + "User" + ] + }, + "site_admin": { + "type": "boolean" + }, + "starred_at": { + "type": "string", + "examples": [ + "\"2020-07-09T00:17:55Z\"" + ] + } + }, + "required": [ + "avatar_url", + "events_url", + "followers_url", + "following_url", + "gists_url", + "gravatar_id", + "html_url", + "id", + "node_id", + "login", + "organizations_url", + "received_events_url", + "repos_url", + "site_admin", + "starred_url", + "subscriptions_url", + "type", + "url" + ] + } + ] + }, + "dismissed_reason": { + "type": [ + "string", + "null" + ], + "description": "**Required when the `state` is `dismissed`.** The reason for dismissing the Dependabot alert.", + "enum": [ + "fix_started", + "inaccurate", + "no_bandwidth", + "not_used", + "tolerable_risk", + null + ] + }, + "dismissed_comment": { + "type": [ + "string", + "null" + ], + "description": "An optional comment associated with the alert's dismissal. The maximum size is 280 characters.", + "maxLength": 280 + }, + "fixed_at": { + "type": [ + "string", + "null" + ], + "description": "The time that the alert was no longer detected and was considered fixed in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.", + "format": "date-time", + "readOnly": true + } + }, + "required": [ + "number", + "state", + "dependency", + "security_advisory", + "security_vulnerability", + "url", + "html_url", + "dismissed_at", + "dismissed_by", + "dismissed_reason", + "dismissed_comment", + "fixed_at", + "created_at", + "updated_at" + ] + } + } + } + ], + "previews": [], + "descriptionHTML": "You must use an access token with the security_events scope to use this endpoint with private repositories.\nYou can also use tokens with the public_repo scope for public repositories only.\nGitHub Apps must have Dependabot alerts read permission to use this endpoint.
OK
" + }, + { + "httpStatusCode": "304", + "description": "Not modified
" + }, + { + "httpStatusCode": "403", + "description": "Forbidden
" + }, + { + "httpStatusCode": "404", + "description": "Resource not found
" + } + ] + }, + { + "serverUrl": "https://api.github.com", + "verb": "patch", + "requestPath": "/repos/{owner}/{repo}/dependabot/alerts/{alert_number}", + "title": "Update a Dependabot alert", + "category": "dependabot", + "subcategory": "alerts", + "parameters": [ + { + "name": "owner", + "description": "The account owner of the repository. The name is not case sensitive.
", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + }, + { + "name": "repo", + "description": "The name of the repository. The name is not case sensitive.
", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + }, + { + "name": "alert_number", + "in": "path", + "description": "The number that identifies a Dependabot alert in its repository. You can find this at the end of the URL for a Dependabot alert within GitHub, or in number fields in the response from the GET /repos/{owner}/{repo}/dependabot/alerts operation.
Sets the status of the dependabot alert. You must provide dismissed_reason when you set the state to dismissed.
Required when the state is dismissed. The reason for dismissing the Dependabot alert.
An optional comment associated with the alert's dismissal. The maximum size is 280 characters.
" + } + ], + "enabledForGitHubApps": true, + "codeExamples": [ + { + "key": "default", + "request": { + "contentType": "application/json", + "description": "Example", + "acceptHeader": "application/vnd.github.v3+json", + "bodyParameters": { + "state": "dismissed", + "dismissed_reason": "tolerable_risk", + "dismissed_comment": "This alert is accurate but we use a sanitizer." + }, + "parameters": { + "owner": "OWNER", + "repo": "REPO", + "alert_number": "ALERT_NUMBER" + } + }, + "response": { + "statusCode": "200", + "contentType": "application/json", + "description": "Response
", + "example": { + "number": 2, + "state": "dismissed", + "dependency": { + "package": { + "ecosystem": "pip", + "name": "django" + }, + "manifest_path": "path/to/requirements.txt", + "scope": "runtime" + }, + "security_advisory": { + "ghsa_id": "GHSA-rf4j-j272-fj86", + "cve_id": "CVE-2018-6188", + "summary": "Django allows remote attackers to obtain potentially sensitive information by leveraging data exposure from the confirm_login_allowed() method, as demonstrated by discovering whether a user account is inactive", + "description": "django.contrib.auth.forms.AuthenticationForm in Django 2.0 before 2.0.2, and 1.11.8 and 1.11.9, allows remote attackers to obtain potentially sensitive information by leveraging data exposure from the confirm_login_allowed() method, as demonstrated by discovering whether a user account is inactive.", + "severity": "high", + "identifiers": [ + { + "type": "GHSA", + "value": "GHSA-rf4j-j272-fj86" + }, + { + "type": "CVE", + "value": "CVE-2018-6188" + } + ], + "references": [ + { + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-6188" + }, + { + "url": "https://github.com/advisories/GHSA-rf4j-j272-fj86" + }, + { + "url": "https://usn.ubuntu.com/3559-1/" + }, + { + "url": "https://www.djangoproject.com/weblog/2018/feb/01/security-releases/" + }, + { + "url": "http://www.securitytracker.com/id/1040422" + } + ], + "published_at": "2018-10-03T21:13:54Z", + "updated_at": "2022-04-26T18:35:37Z", + "withdrawn_at": null, + "vulnerabilities": [ + { + "package": { + "ecosystem": "pip", + "name": "django" + }, + "severity": "high", + "vulnerable_version_range": ">= 2.0.0, < 2.0.2", + "first_patched_version": { + "identifier": "2.0.2" + } + }, + { + "package": { + "ecosystem": "pip", + "name": "django" + }, + "severity": "high", + "vulnerable_version_range": ">= 1.11.8, < 1.11.10", + "first_patched_version": { + "identifier": "1.11.10" + } + } + ], + "cvss": { + "vector_string": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", + "score": 7.5 + }, + "cwes": [ + { + "cwe_id": "CWE-200", + "name": "Exposure of Sensitive Information to an Unauthorized Actor" + } + ] + }, + "security_vulnerability": { + "package": { + "ecosystem": "pip", + "name": "django" + }, + "severity": "high", + "vulnerable_version_range": ">= 2.0.0, < 2.0.2", + "first_patched_version": { + "identifier": "2.0.2" + } + }, + "url": "https://api.github.com/repos/octocat/hello-world/dependabot/alerts/2", + "html_url": "https://github.com/octocat/hello-world/security/dependabot/2", + "created_at": "2022-06-15T07:43:03Z", + "updated_at": "2022-08-23T14:29:47Z", + "dismissed_at": "2022-08-23T14:29:47Z", + "dismissed_by": { + "login": "octocat", + "id": 1, + "node_id": "MDQ6VXNlcjE=", + "avatar_url": "https://github.com/images/error/octocat_happy.gif", + "gravatar_id": "", + "url": "https://api.github.com/users/octocat", + "html_url": "https://github.com/octocat", + "followers_url": "https://api.github.com/users/octocat/followers", + "following_url": "https://api.github.com/users/octocat/following{/other_user}", + "gists_url": "https://api.github.com/users/octocat/gists{/gist_id}", + "starred_url": "https://api.github.com/users/octocat/starred{/owner}{/repo}", + "subscriptions_url": "https://api.github.com/users/octocat/subscriptions", + "organizations_url": "https://api.github.com/users/octocat/orgs", + "repos_url": "https://api.github.com/users/octocat/repos", + "events_url": "https://api.github.com/users/octocat/events{/privacy}", + "received_events_url": "https://api.github.com/users/octocat/received_events", + "type": "User", + "site_admin": false + }, + "dismissed_reason": "tolerable_risk", + "dismissed_comment": "This alert is accurate but we use a sanitizer.", + "fixed_at": null + }, + "schema": { + "type": "object", + "properties": { + "number": { + "type": "integer", + "description": "The security alert number.", + "readOnly": true + }, + "state": { + "type": "string", + "description": "State of a Dependabot alert.", + "enum": [ + "dismissed", + "fixed", + "open" + ] + }, + "dependency": { + "type": "object", + "readOnly": true, + "properties": { + "package": { + "type": "object", + "description": "The details of the vulnerable package.", + "readOnly": true, + "properties": { + "ecosystem": { + "type": "string" + }, + "name": { + "type": "string" + } + } + }, + "manifest_path": { + "type": "string", + "description": "The path to the manifest filename.", + "readOnly": true + }, + "scope": { + "type": [ + "string", + "null" + ], + "description": "The scope of the vulnerable dependency.", + "readOnly": true, + "enum": [ + "development", + "runtime", + null + ] + } + } + }, + "security_advisory": { + "type": "object", + "description": "The details of the security advisory, including summary, description, and severity.", + "readOnly": true, + "properties": { + "ghsa_id": { + "type": "string" + }, + "cve_id": { + "type": [ + "string", + "null" + ] + }, + "summary": { + "type": "string" + }, + "description": { + "type": "string" + }, + "severity": { + "type": "string", + "enum": [ + "low", + "medium", + "high", + "critical" + ] + }, + "identifiers": { + "type": "array", + "items": { + "type": "object", + "properties": { + "type": { + "type": "string", + "enum": [ + "GHSA", + "CVE" + ] + }, + "value": { + "type": "string" + } + }, + "required": [ + "value", + "type" + ], + "additionalProperties": false + } + }, + "references": { + "type": "array", + "items": { + "type": "object", + "properties": { + "url": { + "type": "string", + "format": "uri" + } + }, + "required": [ + "url" + ], + "additionalProperties": false + } + }, + "cvss": { + "type": "object", + "properties": { + "score": { + "type": "number" + }, + "vector_string": { + "type": [ + "string", + "null" + ] + } + }, + "required": [ + "vector_string", + "score" + ], + "additionalProperties": false + }, + "cwes": { + "type": "array", + "items": { + "type": "object", + "properties": { + "cwe_id": { + "type": "string" + }, + "name": { + "type": "string" + } + }, + "required": [ + "cwe_id", + "name" + ], + "additionalProperties": false + } + }, + "published_at": { + "type": "string", + "format": "date-time" + }, + "updated_at": { + "type": "string", + "format": "date-time" + }, + "vulnerabilities": { + "type": "array", + "items": { + "type": "object", + "properties": { + "first_patched_version": { + "type": [ + "object", + "null" + ], + "properties": { + "identifier": { + "type": "string" + } + }, + "required": [ + "identifier" + ], + "additionalProperties": false + }, + "package": { + "type": "object", + "properties": { + "ecosystem": { + "type": "string" + }, + "name": { + "type": "string" + } + }, + "required": [ + "ecosystem", + "name" + ], + "additionalProperties": false + }, + "severity": { + "type": "string" + }, + "vulnerable_version_range": { + "type": "string" + } + }, + "required": [ + "package", + "severity", + "vulnerable_version_range", + "first_patched_version" + ], + "additionalProperties": false + } + }, + "withdrawn_at": { + "type": [ + "string", + "null" + ], + "format": "date-time" + } + }, + "required": [ + "cvss", + "cwes", + "ghsa_id", + "summary", + "description", + "severity", + "identifiers", + "references", + "published_at", + "updated_at", + "withdrawn_at", + "vulnerabilities" + ], + "additionalProperties": false + }, + "security_vulnerability": { + "type": "object", + "description": "The details of the vulnerability of a security advisory.", + "readOnly": true, + "properties": { + "package": { + "type": "object", + "description": "The details of the vulnerable package.", + "readOnly": true, + "properties": { + "ecosystem": { + "type": "string" + }, + "name": { + "type": "string" + } + } + }, + "severity": { + "type": "string" + }, + "vulnerable_version_range": { + "type": "string" + }, + "first_patched_version": { + "type": "object", + "properties": { + "identifier": { + "type": "string" + } + } + } + } + }, + "created_at": { + "type": "string", + "description": "The time that the alert was created in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.", + "format": "date-time", + "readOnly": true + }, + "updated_at": { + "type": "string", + "description": "The time that the alert was last updated in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.", + "format": "date-time", + "readOnly": true + }, + "url": { + "type": "string", + "description": "The REST API URL of the alert resource.", + "format": "uri", + "readOnly": true + }, + "html_url": { + "type": "string", + "description": "The GitHub URL of the alert resource.", + "format": "uri", + "readOnly": true + }, + "dismissed_at": { + "type": [ + "string", + "null" + ], + "description": "The time that the alert was dismissed in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.", + "format": "date-time", + "readOnly": true + }, + "dismissed_by": { + "anyOf": [ + { + "type": "null" + }, + { + "title": "Simple User", + "description": "Simple User", + "type": "object", + "properties": { + "name": { + "type": [ + "string", + "null" + ] + }, + "email": { + "type": [ + "string", + "null" + ] + }, + "login": { + "type": "string", + "examples": [ + "octocat" + ] + }, + "id": { + "type": "integer", + "examples": [ + 1 + ] + }, + "node_id": { + "type": "string", + "examples": [ + "MDQ6VXNlcjE=" + ] + }, + "avatar_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://github.com/images/error/octocat_happy.gif" + ] + }, + "gravatar_id": { + "type": [ + "string", + "null" + ], + "examples": [ + "41d064eb2195891e12d0413f63227ea7" + ] + }, + "url": { + "type": "string", + "format": "uri", + "examples": [ + "https://api.github.com/users/octocat" + ] + }, + "html_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://github.com/octocat" + ] + }, + "followers_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://api.github.com/users/octocat/followers" + ] + }, + "following_url": { + "type": "string", + "examples": [ + "https://api.github.com/users/octocat/following{/other_user}" + ] + }, + "gists_url": { + "type": "string", + "examples": [ + "https://api.github.com/users/octocat/gists{/gist_id}" + ] + }, + "starred_url": { + "type": "string", + "examples": [ + "https://api.github.com/users/octocat/starred{/owner}{/repo}" + ] + }, + "subscriptions_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://api.github.com/users/octocat/subscriptions" + ] + }, + "organizations_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://api.github.com/users/octocat/orgs" + ] + }, + "repos_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://api.github.com/users/octocat/repos" + ] + }, + "events_url": { + "type": "string", + "examples": [ + "https://api.github.com/users/octocat/events{/privacy}" + ] + }, + "received_events_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://api.github.com/users/octocat/received_events" + ] + }, + "type": { + "type": "string", + "examples": [ + "User" + ] + }, + "site_admin": { + "type": "boolean" + }, + "starred_at": { + "type": "string", + "examples": [ + "\"2020-07-09T00:17:55Z\"" + ] + } + }, + "required": [ + "avatar_url", + "events_url", + "followers_url", + "following_url", + "gists_url", + "gravatar_id", + "html_url", + "id", + "node_id", + "login", + "organizations_url", + "received_events_url", + "repos_url", + "site_admin", + "starred_url", + "subscriptions_url", + "type", + "url" + ] + } + ] + }, + "dismissed_reason": { + "type": [ + "string", + "null" + ], + "description": "**Required when the `state` is `dismissed`.** The reason for dismissing the Dependabot alert.", + "enum": [ + "fix_started", + "inaccurate", + "no_bandwidth", + "not_used", + "tolerable_risk", + null + ] + }, + "dismissed_comment": { + "type": [ + "string", + "null" + ], + "description": "An optional comment associated with the alert's dismissal. The maximum size is 280 characters.", + "maxLength": 280 + }, + "fixed_at": { + "type": [ + "string", + "null" + ], + "description": "The time that the alert was no longer detected and was considered fixed in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.", + "format": "date-time", + "readOnly": true + } + }, + "required": [ + "number", + "state", + "dependency", + "security_advisory", + "security_vulnerability", + "url", + "html_url", + "dismissed_at", + "dismissed_by", + "dismissed_reason", + "dismissed_comment", + "fixed_at", + "created_at", + "updated_at" + ] + } + } + } + ], + "previews": [], + "descriptionHTML": "You must use an access token with the security_events scope to use this endpoint with private repositories.\nYou can also use tokens with the public_repo scope for public repositories only.\nGitHub Apps must have Dependabot alerts write permission to use this endpoint.
OK
" + }, + { + "httpStatusCode": "304", + "description": "Not modified
" + }, + { + "httpStatusCode": "400", + "description": "Bad Request
" + }, + { + "httpStatusCode": "403", + "description": "Forbidden
" + }, + { + "httpStatusCode": "404", + "description": "Resource not found
" + }, + { + "httpStatusCode": "409", + "description": "Conflict
" + }, + { + "httpStatusCode": "422", + "description": "Validation failed
" + } + ] + } + ], "secrets": [ { "serverUrl": "https://api.github.com", diff --git a/lib/rest/static/dereferenced/api.github.com.deref.json b/lib/rest/static/dereferenced/api.github.com.deref.json index 4f5f972f0b..92f3309bff 100644 --- a/lib/rest/static/dereferenced/api.github.com.deref.json +++ b/lib/rest/static/dereferenced/api.github.com.deref.json @@ -286055,6 +286055,2725 @@ } } }, + "/repos/{owner}/{repo}/dependabot/alerts": { + "get": { + "summary": "List Dependabot alerts for a repository", + "description": "You must use an access token with the `security_events` scope to use this endpoint with private repositories.\nYou can also use tokens with the `public_repo` scope for public repositories only.\nGitHub Apps must have **Dependabot alerts** read permission to use this endpoint.", + "tags": [ + "dependabot" + ], + "operationId": "dependabot/list-alerts-for-repo", + "externalDocs": { + "description": "API method documentation", + "url": "https://docs.github.com/rest/reference/dependabot#list-dependabot-alerts-for-a-repository" + }, + "parameters": [ + { + "name": "owner", + "description": "The account owner of the repository. The name is not case sensitive.", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + }, + { + "name": "repo", + "description": "The name of the repository. The name is not case sensitive.", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + }, + { + "name": "state", + "description": "A comma-separated list of states. If specified, only alerts with these states will be returned.\n\nCan be: `dismissed`, `fixed`, `open`", + "in": "query", + "schema": { + "type": "string" + } + }, + { + "name": "severity", + "description": "A comma-separated list of severities. If specified, only alerts with these severities will be returned.\n\nCan be: `low`, `medium`, `high`, `critical`", + "in": "query", + "schema": { + "type": "string" + } + }, + { + "name": "ecosystem", + "description": "A comma-separated list of ecosystems. If specified, only alerts for these ecosystems will be returned.\n\nCan be: `composer`, `go`, `maven`, `npm`, `nuget`, `pip`, `rubygems`, `rust`", + "in": "query", + "schema": { + "type": "string" + } + }, + { + "name": "package", + "description": "A comma-separated list of package names. If specified, only alerts for these packages will be returned.", + "in": "query", + "schema": { + "type": "string" + } + }, + { + "name": "manifest", + "description": "A comma-separated list of full manifest paths. If specified, only alerts for these manifests will be returned.", + "in": "query", + "schema": { + "type": "string" + } + }, + { + "name": "scope", + "description": "Scope of the dependency on a Dependabot alert.", + "in": "query", + "schema": { + "type": [ + "string", + "null" + ], + "description": "The scope of the vulnerable dependency.", + "readOnly": true, + "enum": [ + "development", + "runtime", + null + ] + } + }, + { + "name": "sort", + "description": "The property by which to sort the results.\n`created` means when the alert was created.\n`updated` means when the alert's state last changed.", + "in": "query", + "required": false, + "schema": { + "type": "string", + "enum": [ + "created", + "updated" + ], + "default": "created" + } + }, + { + "name": "direction", + "description": "The direction to sort the results by.", + "in": "query", + "required": false, + "schema": { + "type": "string", + "enum": [ + "asc", + "desc" + ], + "default": "desc" + } + }, + { + "name": "page", + "description": "Page number of the results to fetch.", + "in": "query", + "schema": { + "type": "integer", + "default": 1 + } + }, + { + "name": "per_page", + "description": "The number of results per page (max 100).", + "in": "query", + "schema": { + "type": "integer", + "default": 30 + } + } + ], + "responses": { + "200": { + "description": "Response", + "content": { + "application/json": { + "schema": { + "type": "array", + "items": { + "type": "object", + "properties": { + "number": { + "type": "integer", + "description": "The security alert number.", + "readOnly": true + }, + "state": { + "type": "string", + "description": "State of a Dependabot alert.", + "enum": [ + "dismissed", + "fixed", + "open" + ] + }, + "dependency": { + "type": "object", + "readOnly": true, + "properties": { + "package": { + "type": "object", + "description": "The details of the vulnerable package.", + "readOnly": true, + "properties": { + "ecosystem": { + "type": "string" + }, + "name": { + "type": "string" + } + } + }, + "manifest_path": { + "type": "string", + "description": "The path to the manifest filename.", + "readOnly": true + }, + "scope": { + "type": [ + "string", + "null" + ], + "description": "The scope of the vulnerable dependency.", + "readOnly": true, + "enum": [ + "development", + "runtime", + null + ] + } + } + }, + "security_advisory": { + "type": "object", + "description": "The details of the security advisory, including summary, description, and severity.", + "readOnly": true, + "properties": { + "ghsa_id": { + "type": "string" + }, + "cve_id": { + "type": [ + "string", + "null" + ] + }, + "summary": { + "type": "string" + }, + "description": { + "type": "string" + }, + "severity": { + "type": "string", + "enum": [ + "low", + "medium", + "high", + "critical" + ] + }, + "identifiers": { + "type": "array", + "items": { + "type": "object", + "properties": { + "type": { + "type": "string", + "enum": [ + "GHSA", + "CVE" + ] + }, + "value": { + "type": "string" + } + }, + "required": [ + "value", + "type" + ], + "additionalProperties": false + } + }, + "references": { + "type": "array", + "items": { + "type": "object", + "properties": { + "url": { + "type": "string", + "format": "uri" + } + }, + "required": [ + "url" + ], + "additionalProperties": false + } + }, + "cvss": { + "type": "object", + "properties": { + "score": { + "type": "number" + }, + "vector_string": { + "type": [ + "string", + "null" + ] + } + }, + "required": [ + "vector_string", + "score" + ], + "additionalProperties": false + }, + "cwes": { + "type": "array", + "items": { + "type": "object", + "properties": { + "cwe_id": { + "type": "string" + }, + "name": { + "type": "string" + } + }, + "required": [ + "cwe_id", + "name" + ], + "additionalProperties": false + } + }, + "published_at": { + "type": "string", + "format": "date-time" + }, + "updated_at": { + "type": "string", + "format": "date-time" + }, + "vulnerabilities": { + "type": "array", + "items": { + "type": "object", + "properties": { + "first_patched_version": { + "type": [ + "object", + "null" + ], + "properties": { + "identifier": { + "type": "string" + } + }, + "required": [ + "identifier" + ], + "additionalProperties": false + }, + "package": { + "type": "object", + "properties": { + "ecosystem": { + "type": "string" + }, + "name": { + "type": "string" + } + }, + "required": [ + "ecosystem", + "name" + ], + "additionalProperties": false + }, + "severity": { + "type": "string" + }, + "vulnerable_version_range": { + "type": "string" + } + }, + "required": [ + "package", + "severity", + "vulnerable_version_range", + "first_patched_version" + ], + "additionalProperties": false + } + }, + "withdrawn_at": { + "type": [ + "string", + "null" + ], + "format": "date-time" + } + }, + "required": [ + "cvss", + "cwes", + "ghsa_id", + "summary", + "description", + "severity", + "identifiers", + "references", + "published_at", + "updated_at", + "withdrawn_at", + "vulnerabilities" + ], + "additionalProperties": false + }, + "security_vulnerability": { + "type": "object", + "description": "The details of the vulnerability of a security advisory.", + "readOnly": true, + "properties": { + "package": { + "type": "object", + "description": "The details of the vulnerable package.", + "readOnly": true, + "properties": { + "ecosystem": { + "type": "string" + }, + "name": { + "type": "string" + } + } + }, + "severity": { + "type": "string" + }, + "vulnerable_version_range": { + "type": "string" + }, + "first_patched_version": { + "type": "object", + "properties": { + "identifier": { + "type": "string" + } + } + } + } + }, + "created_at": { + "type": "string", + "description": "The time that the alert was created in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.", + "format": "date-time", + "readOnly": true + }, + "updated_at": { + "type": "string", + "description": "The time that the alert was last updated in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.", + "format": "date-time", + "readOnly": true + }, + "url": { + "type": "string", + "description": "The REST API URL of the alert resource.", + "format": "uri", + "readOnly": true + }, + "html_url": { + "type": "string", + "description": "The GitHub URL of the alert resource.", + "format": "uri", + "readOnly": true + }, + "dismissed_at": { + "type": [ + "string", + "null" + ], + "description": "The time that the alert was dismissed in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.", + "format": "date-time", + "readOnly": true + }, + "dismissed_by": { + "anyOf": [ + { + "type": "null" + }, + { + "title": "Simple User", + "description": "Simple User", + "type": "object", + "properties": { + "name": { + "type": [ + "string", + "null" + ] + }, + "email": { + "type": [ + "string", + "null" + ] + }, + "login": { + "type": "string", + "examples": [ + "octocat" + ] + }, + "id": { + "type": "integer", + "examples": [ + 1 + ] + }, + "node_id": { + "type": "string", + "examples": [ + "MDQ6VXNlcjE=" + ] + }, + "avatar_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://github.com/images/error/octocat_happy.gif" + ] + }, + "gravatar_id": { + "type": [ + "string", + "null" + ], + "examples": [ + "41d064eb2195891e12d0413f63227ea7" + ] + }, + "url": { + "type": "string", + "format": "uri", + "examples": [ + "https://api.github.com/users/octocat" + ] + }, + "html_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://github.com/octocat" + ] + }, + "followers_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://api.github.com/users/octocat/followers" + ] + }, + "following_url": { + "type": "string", + "examples": [ + "https://api.github.com/users/octocat/following{/other_user}" + ] + }, + "gists_url": { + "type": "string", + "examples": [ + "https://api.github.com/users/octocat/gists{/gist_id}" + ] + }, + "starred_url": { + "type": "string", + "examples": [ + "https://api.github.com/users/octocat/starred{/owner}{/repo}" + ] + }, + "subscriptions_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://api.github.com/users/octocat/subscriptions" + ] + }, + "organizations_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://api.github.com/users/octocat/orgs" + ] + }, + "repos_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://api.github.com/users/octocat/repos" + ] + }, + "events_url": { + "type": "string", + "examples": [ + "https://api.github.com/users/octocat/events{/privacy}" + ] + }, + "received_events_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://api.github.com/users/octocat/received_events" + ] + }, + "type": { + "type": "string", + "examples": [ + "User" + ] + }, + "site_admin": { + "type": "boolean" + }, + "starred_at": { + "type": "string", + "examples": [ + "\"2020-07-09T00:17:55Z\"" + ] + } + }, + "required": [ + "avatar_url", + "events_url", + "followers_url", + "following_url", + "gists_url", + "gravatar_id", + "html_url", + "id", + "node_id", + "login", + "organizations_url", + "received_events_url", + "repos_url", + "site_admin", + "starred_url", + "subscriptions_url", + "type", + "url" + ] + } + ] + }, + "dismissed_reason": { + "type": [ + "string", + "null" + ], + "description": "**Required when the `state` is `dismissed`.** The reason for dismissing the Dependabot alert.", + "enum": [ + "fix_started", + "inaccurate", + "no_bandwidth", + "not_used", + "tolerable_risk", + null + ] + }, + "dismissed_comment": { + "type": [ + "string", + "null" + ], + "description": "An optional comment associated with the alert's dismissal. The maximum size is 280 characters.", + "maxLength": 280 + }, + "fixed_at": { + "type": [ + "string", + "null" + ], + "description": "The time that the alert was no longer detected and was considered fixed in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.", + "format": "date-time", + "readOnly": true + } + }, + "required": [ + "number", + "state", + "dependency", + "security_advisory", + "security_vulnerability", + "url", + "html_url", + "dismissed_at", + "dismissed_by", + "dismissed_reason", + "dismissed_comment", + "fixed_at", + "created_at", + "updated_at" + ] + } + }, + "examples": { + "default": { + "value": [ + { + "number": 2, + "state": "dismissed", + "dependency": { + "package": { + "ecosystem": "pip", + "name": "django" + }, + "manifest_path": "path/to/requirements.txt", + "scope": "runtime" + }, + "security_advisory": { + "ghsa_id": "GHSA-rf4j-j272-fj86", + "cve_id": "CVE-2018-6188", + "summary": "Django allows remote attackers to obtain potentially sensitive information by leveraging data exposure from the confirm_login_allowed() method, as demonstrated by discovering whether a user account is inactive", + "description": "django.contrib.auth.forms.AuthenticationForm in Django 2.0 before 2.0.2, and 1.11.8 and 1.11.9, allows remote attackers to obtain potentially sensitive information by leveraging data exposure from the confirm_login_allowed() method, as demonstrated by discovering whether a user account is inactive.", + "severity": "high", + "identifiers": [ + { + "type": "GHSA", + "value": "GHSA-rf4j-j272-fj86" + }, + { + "type": "CVE", + "value": "CVE-2018-6188" + } + ], + "references": [ + { + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-6188" + }, + { + "url": "https://github.com/advisories/GHSA-rf4j-j272-fj86" + }, + { + "url": "https://usn.ubuntu.com/3559-1/" + }, + { + "url": "https://www.djangoproject.com/weblog/2018/feb/01/security-releases/" + }, + { + "url": "http://www.securitytracker.com/id/1040422" + } + ], + "published_at": "2018-10-03T21:13:54Z", + "updated_at": "2022-04-26T18:35:37Z", + "withdrawn_at": null, + "vulnerabilities": [ + { + "package": { + "ecosystem": "pip", + "name": "django" + }, + "severity": "high", + "vulnerable_version_range": ">= 2.0.0, < 2.0.2", + "first_patched_version": { + "identifier": "2.0.2" + } + }, + { + "package": { + "ecosystem": "pip", + "name": "django" + }, + "severity": "high", + "vulnerable_version_range": ">= 1.11.8, < 1.11.10", + "first_patched_version": { + "identifier": "1.11.10" + } + } + ], + "cvss": { + "vector_string": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", + "score": 7.5 + }, + "cwes": [ + { + "cwe_id": "CWE-200", + "name": "Exposure of Sensitive Information to an Unauthorized Actor" + } + ] + }, + "security_vulnerability": { + "package": { + "ecosystem": "pip", + "name": "django" + }, + "severity": "high", + "vulnerable_version_range": ">= 2.0.0, < 2.0.2", + "first_patched_version": { + "identifier": "2.0.2" + } + }, + "url": "https://api.github.com/repos/octocat/hello-world/dependabot/alerts/2", + "html_url": "https://github.com/octocat/hello-world/security/dependabot/2", + "created_at": "2022-06-15T07:43:03Z", + "updated_at": "2022-08-23T14:29:47Z", + "dismissed_at": "2022-08-23T14:29:47Z", + "dismissed_by": { + "login": "octocat", + "id": 1, + "node_id": "MDQ6VXNlcjE=", + "avatar_url": "https://github.com/images/error/octocat_happy.gif", + "gravatar_id": "", + "url": "https://api.github.com/users/octocat", + "html_url": "https://github.com/octocat", + "followers_url": "https://api.github.com/users/octocat/followers", + "following_url": "https://api.github.com/users/octocat/following{/other_user}", + "gists_url": "https://api.github.com/users/octocat/gists{/gist_id}", + "starred_url": "https://api.github.com/users/octocat/starred{/owner}{/repo}", + "subscriptions_url": "https://api.github.com/users/octocat/subscriptions", + "organizations_url": "https://api.github.com/users/octocat/orgs", + "repos_url": "https://api.github.com/users/octocat/repos", + "events_url": "https://api.github.com/users/octocat/events{/privacy}", + "received_events_url": "https://api.github.com/users/octocat/received_events", + "type": "User", + "site_admin": false + }, + "dismissed_reason": "tolerable_risk", + "dismissed_comment": "This alert is accurate but we use a sanitizer.", + "fixed_at": null + }, + { + "number": 1, + "state": "open", + "dependency": { + "package": { + "ecosystem": "pip", + "name": "ansible" + }, + "manifest_path": "path/to/requirements.txt", + "scope": "runtime" + }, + "security_advisory": { + "ghsa_id": "GHSA-8f4m-hccc-8qph", + "cve_id": "CVE-2021-20191", + "summary": "Insertion of Sensitive Information into Log File in ansible", + "description": "A flaw was found in ansible. Credentials, such as secrets, are being disclosed in console log by default and not protected by no_log feature when using those modules. An attacker can take advantage of this information to steal those credentials. The highest threat from this vulnerability is to data confidentiality.", + "severity": "medium", + "identifiers": [ + { + "type": "GHSA", + "value": "GHSA-8f4m-hccc-8qph" + }, + { + "type": "CVE", + "value": "CVE-2021-20191" + } + ], + "references": [ + { + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20191" + }, + { + "url": "https://access.redhat.com/security/cve/cve-2021-20191" + }, + { + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1916813" + } + ], + "published_at": "2021-06-01T17:38:00Z", + "updated_at": "2021-08-12T23:06:00Z", + "withdrawn_at": null, + "vulnerabilities": [ + { + "package": { + "ecosystem": "pip", + "name": "ansible" + }, + "severity": "medium", + "vulnerable_version_range": ">= 2.9.0, < 2.9.18", + "first_patched_version": { + "identifier": "2.9.18" + } + }, + { + "package": { + "ecosystem": "pip", + "name": "ansible" + }, + "severity": "medium", + "vulnerable_version_range": "< 2.8.19", + "first_patched_version": { + "identifier": "2.8.19" + } + }, + { + "package": { + "ecosystem": "pip", + "name": "ansible" + }, + "severity": "medium", + "vulnerable_version_range": ">= 2.10.0, < 2.10.7", + "first_patched_version": { + "identifier": "2.10.7" + } + } + ], + "cvss": { + "vector_string": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", + "score": 5.5 + }, + "cwes": [ + { + "cwe_id": "CWE-532", + "name": "Insertion of Sensitive Information into Log File" + } + ] + }, + "security_vulnerability": { + "package": { + "ecosystem": "pip", + "name": "ansible" + }, + "severity": "medium", + "vulnerable_version_range": "< 2.8.19", + "first_patched_version": { + "identifier": "2.8.19" + } + }, + "url": "https://api.github.com/repos/octocat/hello-world/dependabot/alerts/1", + "html_url": "https://github.com/octocat/hello-world/security/dependabot/1", + "created_at": "2022-06-14T15:21:52Z", + "updated_at": "2022-06-14T15:21:52Z", + "dismissed_at": null, + "dismissed_by": null, + "dismissed_reason": null, + "dismissed_comment": null, + "fixed_at": null + } + ] + } + } + } + } + }, + "304": { + "description": "Not modified" + }, + "403": { + "description": "Forbidden", + "content": { + "application/json": { + "schema": { + "title": "Basic Error", + "description": "Basic Error", + "type": "object", + "properties": { + "message": { + "type": "string" + }, + "documentation_url": { + "type": "string" + }, + "url": { + "type": "string" + }, + "status": { + "type": "string" + } + } + } + } + } + }, + "404": { + "description": "Resource not found", + "content": { + "application/json": { + "schema": { + "title": "Basic Error", + "description": "Basic Error", + "type": "object", + "properties": { + "message": { + "type": "string" + }, + "documentation_url": { + "type": "string" + }, + "url": { + "type": "string" + }, + "status": { + "type": "string" + } + } + } + } + } + }, + "422": { + "description": "Validation failed", + "content": { + "application/json": { + "schema": { + "title": "Validation Error Simple", + "description": "Validation Error Simple", + "type": "object", + "required": [ + "message", + "documentation_url" + ], + "properties": { + "message": { + "type": "string" + }, + "documentation_url": { + "type": "string" + }, + "errors": { + "type": "array", + "items": { + "type": "string" + } + } + } + } + } + } + } + }, + "x-github": { + "githubCloudOnly": false, + "enabledForGitHubApps": true, + "previews": [ + + ], + "category": "dependabot", + "subcategory": "alerts" + } + } + }, + "/repos/{owner}/{repo}/dependabot/alerts/{alert_number}": { + "get": { + "summary": "Get a Dependabot alert", + "description": "You must use an access token with the `security_events` scope to use this endpoint with private repositories.\nYou can also use tokens with the `public_repo` scope for public repositories only.\nGitHub Apps must have **Dependabot alerts** read permission to use this endpoint.", + "tags": [ + "dependabot" + ], + "operationId": "dependabot/get-alert", + "externalDocs": { + "description": "API method documentation", + "url": "https://docs.github.com/rest/reference/dependabot#get-a-dependabot-alert" + }, + "parameters": [ + { + "name": "owner", + "description": "The account owner of the repository. The name is not case sensitive.", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + }, + { + "name": "repo", + "description": "The name of the repository. The name is not case sensitive.", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + }, + { + "name": "alert_number", + "in": "path", + "description": "The number that identifies a Dependabot alert in its repository. You can find this at the end of the URL for a Dependabot alert within GitHub, or in `number` fields in the response from the `GET /repos/{owner}/{repo}/dependabot/alerts` operation.", + "required": true, + "schema": { + "type": "integer", + "description": "The security alert number.", + "readOnly": true + } + } + ], + "responses": { + "200": { + "description": "Response", + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "number": { + "type": "integer", + "description": "The security alert number.", + "readOnly": true + }, + "state": { + "type": "string", + "description": "State of a Dependabot alert.", + "enum": [ + "dismissed", + "fixed", + "open" + ] + }, + "dependency": { + "type": "object", + "readOnly": true, + "properties": { + "package": { + "type": "object", + "description": "The details of the vulnerable package.", + "readOnly": true, + "properties": { + "ecosystem": { + "type": "string" + }, + "name": { + "type": "string" + } + } + }, + "manifest_path": { + "type": "string", + "description": "The path to the manifest filename.", + "readOnly": true + }, + "scope": { + "type": [ + "string", + "null" + ], + "description": "The scope of the vulnerable dependency.", + "readOnly": true, + "enum": [ + "development", + "runtime", + null + ] + } + } + }, + "security_advisory": { + "type": "object", + "description": "The details of the security advisory, including summary, description, and severity.", + "readOnly": true, + "properties": { + "ghsa_id": { + "type": "string" + }, + "cve_id": { + "type": [ + "string", + "null" + ] + }, + "summary": { + "type": "string" + }, + "description": { + "type": "string" + }, + "severity": { + "type": "string", + "enum": [ + "low", + "medium", + "high", + "critical" + ] + }, + "identifiers": { + "type": "array", + "items": { + "type": "object", + "properties": { + "type": { + "type": "string", + "enum": [ + "GHSA", + "CVE" + ] + }, + "value": { + "type": "string" + } + }, + "required": [ + "value", + "type" + ], + "additionalProperties": false + } + }, + "references": { + "type": "array", + "items": { + "type": "object", + "properties": { + "url": { + "type": "string", + "format": "uri" + } + }, + "required": [ + "url" + ], + "additionalProperties": false + } + }, + "cvss": { + "type": "object", + "properties": { + "score": { + "type": "number" + }, + "vector_string": { + "type": [ + "string", + "null" + ] + } + }, + "required": [ + "vector_string", + "score" + ], + "additionalProperties": false + }, + "cwes": { + "type": "array", + "items": { + "type": "object", + "properties": { + "cwe_id": { + "type": "string" + }, + "name": { + "type": "string" + } + }, + "required": [ + "cwe_id", + "name" + ], + "additionalProperties": false + } + }, + "published_at": { + "type": "string", + "format": "date-time" + }, + "updated_at": { + "type": "string", + "format": "date-time" + }, + "vulnerabilities": { + "type": "array", + "items": { + "type": "object", + "properties": { + "first_patched_version": { + "type": [ + "object", + "null" + ], + "properties": { + "identifier": { + "type": "string" + } + }, + "required": [ + "identifier" + ], + "additionalProperties": false + }, + "package": { + "type": "object", + "properties": { + "ecosystem": { + "type": "string" + }, + "name": { + "type": "string" + } + }, + "required": [ + "ecosystem", + "name" + ], + "additionalProperties": false + }, + "severity": { + "type": "string" + }, + "vulnerable_version_range": { + "type": "string" + } + }, + "required": [ + "package", + "severity", + "vulnerable_version_range", + "first_patched_version" + ], + "additionalProperties": false + } + }, + "withdrawn_at": { + "type": [ + "string", + "null" + ], + "format": "date-time" + } + }, + "required": [ + "cvss", + "cwes", + "ghsa_id", + "summary", + "description", + "severity", + "identifiers", + "references", + "published_at", + "updated_at", + "withdrawn_at", + "vulnerabilities" + ], + "additionalProperties": false + }, + "security_vulnerability": { + "type": "object", + "description": "The details of the vulnerability of a security advisory.", + "readOnly": true, + "properties": { + "package": { + "type": "object", + "description": "The details of the vulnerable package.", + "readOnly": true, + "properties": { + "ecosystem": { + "type": "string" + }, + "name": { + "type": "string" + } + } + }, + "severity": { + "type": "string" + }, + "vulnerable_version_range": { + "type": "string" + }, + "first_patched_version": { + "type": "object", + "properties": { + "identifier": { + "type": "string" + } + } + } + } + }, + "created_at": { + "type": "string", + "description": "The time that the alert was created in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.", + "format": "date-time", + "readOnly": true + }, + "updated_at": { + "type": "string", + "description": "The time that the alert was last updated in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.", + "format": "date-time", + "readOnly": true + }, + "url": { + "type": "string", + "description": "The REST API URL of the alert resource.", + "format": "uri", + "readOnly": true + }, + "html_url": { + "type": "string", + "description": "The GitHub URL of the alert resource.", + "format": "uri", + "readOnly": true + }, + "dismissed_at": { + "type": [ + "string", + "null" + ], + "description": "The time that the alert was dismissed in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.", + "format": "date-time", + "readOnly": true + }, + "dismissed_by": { + "anyOf": [ + { + "type": "null" + }, + { + "title": "Simple User", + "description": "Simple User", + "type": "object", + "properties": { + "name": { + "type": [ + "string", + "null" + ] + }, + "email": { + "type": [ + "string", + "null" + ] + }, + "login": { + "type": "string", + "examples": [ + "octocat" + ] + }, + "id": { + "type": "integer", + "examples": [ + 1 + ] + }, + "node_id": { + "type": "string", + "examples": [ + "MDQ6VXNlcjE=" + ] + }, + "avatar_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://github.com/images/error/octocat_happy.gif" + ] + }, + "gravatar_id": { + "type": [ + "string", + "null" + ], + "examples": [ + "41d064eb2195891e12d0413f63227ea7" + ] + }, + "url": { + "type": "string", + "format": "uri", + "examples": [ + "https://api.github.com/users/octocat" + ] + }, + "html_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://github.com/octocat" + ] + }, + "followers_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://api.github.com/users/octocat/followers" + ] + }, + "following_url": { + "type": "string", + "examples": [ + "https://api.github.com/users/octocat/following{/other_user}" + ] + }, + "gists_url": { + "type": "string", + "examples": [ + "https://api.github.com/users/octocat/gists{/gist_id}" + ] + }, + "starred_url": { + "type": "string", + "examples": [ + "https://api.github.com/users/octocat/starred{/owner}{/repo}" + ] + }, + "subscriptions_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://api.github.com/users/octocat/subscriptions" + ] + }, + "organizations_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://api.github.com/users/octocat/orgs" + ] + }, + "repos_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://api.github.com/users/octocat/repos" + ] + }, + "events_url": { + "type": "string", + "examples": [ + "https://api.github.com/users/octocat/events{/privacy}" + ] + }, + "received_events_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://api.github.com/users/octocat/received_events" + ] + }, + "type": { + "type": "string", + "examples": [ + "User" + ] + }, + "site_admin": { + "type": "boolean" + }, + "starred_at": { + "type": "string", + "examples": [ + "\"2020-07-09T00:17:55Z\"" + ] + } + }, + "required": [ + "avatar_url", + "events_url", + "followers_url", + "following_url", + "gists_url", + "gravatar_id", + "html_url", + "id", + "node_id", + "login", + "organizations_url", + "received_events_url", + "repos_url", + "site_admin", + "starred_url", + "subscriptions_url", + "type", + "url" + ] + } + ] + }, + "dismissed_reason": { + "type": [ + "string", + "null" + ], + "description": "**Required when the `state` is `dismissed`.** The reason for dismissing the Dependabot alert.", + "enum": [ + "fix_started", + "inaccurate", + "no_bandwidth", + "not_used", + "tolerable_risk", + null + ] + }, + "dismissed_comment": { + "type": [ + "string", + "null" + ], + "description": "An optional comment associated with the alert's dismissal. The maximum size is 280 characters.", + "maxLength": 280 + }, + "fixed_at": { + "type": [ + "string", + "null" + ], + "description": "The time that the alert was no longer detected and was considered fixed in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.", + "format": "date-time", + "readOnly": true + } + }, + "required": [ + "number", + "state", + "dependency", + "security_advisory", + "security_vulnerability", + "url", + "html_url", + "dismissed_at", + "dismissed_by", + "dismissed_reason", + "dismissed_comment", + "fixed_at", + "created_at", + "updated_at" + ] + }, + "examples": { + "default": { + "value": { + "number": 1, + "state": "open", + "dependency": { + "package": { + "ecosystem": "pip", + "name": "ansible" + }, + "manifest_path": "path/to/requirements.txt", + "scope": "runtime" + }, + "security_advisory": { + "ghsa_id": "GHSA-8f4m-hccc-8qph", + "cve_id": "CVE-2021-20191", + "summary": "Insertion of Sensitive Information into Log File in ansible", + "description": "A flaw was found in ansible. Credentials, such as secrets, are being disclosed in console log by default and not protected by no_log feature when using those modules. An attacker can take advantage of this information to steal those credentials. The highest threat from this vulnerability is to data confidentiality.", + "severity": "medium", + "identifiers": [ + { + "type": "GHSA", + "value": "GHSA-8f4m-hccc-8qph" + }, + { + "type": "CVE", + "value": "CVE-2021-20191" + } + ], + "references": [ + { + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20191" + }, + { + "url": "https://access.redhat.com/security/cve/cve-2021-20191" + }, + { + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1916813" + } + ], + "published_at": "2021-06-01T17:38:00Z", + "updated_at": "2021-08-12T23:06:00Z", + "withdrawn_at": null, + "vulnerabilities": [ + { + "package": { + "ecosystem": "pip", + "name": "ansible" + }, + "severity": "medium", + "vulnerable_version_range": ">= 2.9.0, < 2.9.18", + "first_patched_version": { + "identifier": "2.9.18" + } + }, + { + "package": { + "ecosystem": "pip", + "name": "ansible" + }, + "severity": "medium", + "vulnerable_version_range": "< 2.8.19", + "first_patched_version": { + "identifier": "2.8.19" + } + }, + { + "package": { + "ecosystem": "pip", + "name": "ansible" + }, + "severity": "medium", + "vulnerable_version_range": ">= 2.10.0, < 2.10.7", + "first_patched_version": { + "identifier": "2.10.7" + } + } + ], + "cvss": { + "vector_string": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", + "score": 5.5 + }, + "cwes": [ + { + "cwe_id": "CWE-532", + "name": "Insertion of Sensitive Information into Log File" + } + ] + }, + "security_vulnerability": { + "package": { + "ecosystem": "pip", + "name": "ansible" + }, + "severity": "medium", + "vulnerable_version_range": "< 2.8.19", + "first_patched_version": { + "identifier": "2.8.19" + } + }, + "url": "https://api.github.com/repos/octocat/hello-world/dependabot/alerts/1", + "html_url": "https://github.com/octocat/hello-world/security/dependabot/1", + "created_at": "2022-06-14T15:21:52Z", + "updated_at": "2022-06-14T15:21:52Z", + "dismissed_at": null, + "dismissed_by": null, + "dismissed_reason": null, + "dismissed_comment": null, + "fixed_at": null + } + } + } + } + } + }, + "304": { + "description": "Not modified" + }, + "403": { + "description": "Forbidden", + "content": { + "application/json": { + "schema": { + "title": "Basic Error", + "description": "Basic Error", + "type": "object", + "properties": { + "message": { + "type": "string" + }, + "documentation_url": { + "type": "string" + }, + "url": { + "type": "string" + }, + "status": { + "type": "string" + } + } + } + } + } + }, + "404": { + "description": "Resource not found", + "content": { + "application/json": { + "schema": { + "title": "Basic Error", + "description": "Basic Error", + "type": "object", + "properties": { + "message": { + "type": "string" + }, + "documentation_url": { + "type": "string" + }, + "url": { + "type": "string" + }, + "status": { + "type": "string" + } + } + } + } + } + } + }, + "x-github": { + "githubCloudOnly": false, + "enabledForGitHubApps": true, + "previews": [ + + ], + "category": "dependabot", + "subcategory": "alerts" + } + }, + "patch": { + "summary": "Update a Dependabot alert", + "description": "You must use an access token with the `security_events` scope to use this endpoint with private repositories.\nYou can also use tokens with the `public_repo` scope for public repositories only.\nGitHub Apps must have **Dependabot alerts** write permission to use this endpoint.", + "tags": [ + "dependabot" + ], + "operationId": "dependabot/update-alert", + "externalDocs": { + "description": "API method documentation", + "url": "https://docs.github.com/rest/reference/dependabot#update-a-dependabot-alert" + }, + "parameters": [ + { + "name": "owner", + "description": "The account owner of the repository. The name is not case sensitive.", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + }, + { + "name": "repo", + "description": "The name of the repository. The name is not case sensitive.", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + }, + { + "name": "alert_number", + "in": "path", + "description": "The number that identifies a Dependabot alert in its repository. You can find this at the end of the URL for a Dependabot alert within GitHub, or in `number` fields in the response from the `GET /repos/{owner}/{repo}/dependabot/alerts` operation.", + "required": true, + "schema": { + "type": "integer", + "description": "The security alert number.", + "readOnly": true + } + } + ], + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "state": { + "description": "Sets the status of the dependabot alert. You must provide `dismissed_reason` when you set the state to `dismissed`.", + "type": "string", + "enum": [ + "dismissed", + "open" + ] + }, + "dismissed_reason": { + "type": [ + "string", + "null" + ], + "description": "**Required when the `state` is `dismissed`.** The reason for dismissing the Dependabot alert.", + "enum": [ + "fix_started", + "inaccurate", + "no_bandwidth", + "not_used", + "tolerable_risk", + null + ] + }, + "dismissed_comment": { + "type": [ + "string", + "null" + ], + "description": "An optional comment associated with the alert's dismissal. The maximum size is 280 characters.", + "maxLength": 280 + } + }, + "required": [ + "state" + ], + "additionalProperties": false + }, + "examples": { + "default": { + "value": { + "state": "dismissed", + "dismissed_reason": "tolerable_risk", + "dismissed_comment": "This alert is accurate but we use a sanitizer." + } + } + } + } + } + }, + "responses": { + "200": { + "description": "Response", + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "number": { + "type": "integer", + "description": "The security alert number.", + "readOnly": true + }, + "state": { + "type": "string", + "description": "State of a Dependabot alert.", + "enum": [ + "dismissed", + "fixed", + "open" + ] + }, + "dependency": { + "type": "object", + "readOnly": true, + "properties": { + "package": { + "type": "object", + "description": "The details of the vulnerable package.", + "readOnly": true, + "properties": { + "ecosystem": { + "type": "string" + }, + "name": { + "type": "string" + } + } + }, + "manifest_path": { + "type": "string", + "description": "The path to the manifest filename.", + "readOnly": true + }, + "scope": { + "type": [ + "string", + "null" + ], + "description": "The scope of the vulnerable dependency.", + "readOnly": true, + "enum": [ + "development", + "runtime", + null + ] + } + } + }, + "security_advisory": { + "type": "object", + "description": "The details of the security advisory, including summary, description, and severity.", + "readOnly": true, + "properties": { + "ghsa_id": { + "type": "string" + }, + "cve_id": { + "type": [ + "string", + "null" + ] + }, + "summary": { + "type": "string" + }, + "description": { + "type": "string" + }, + "severity": { + "type": "string", + "enum": [ + "low", + "medium", + "high", + "critical" + ] + }, + "identifiers": { + "type": "array", + "items": { + "type": "object", + "properties": { + "type": { + "type": "string", + "enum": [ + "GHSA", + "CVE" + ] + }, + "value": { + "type": "string" + } + }, + "required": [ + "value", + "type" + ], + "additionalProperties": false + } + }, + "references": { + "type": "array", + "items": { + "type": "object", + "properties": { + "url": { + "type": "string", + "format": "uri" + } + }, + "required": [ + "url" + ], + "additionalProperties": false + } + }, + "cvss": { + "type": "object", + "properties": { + "score": { + "type": "number" + }, + "vector_string": { + "type": [ + "string", + "null" + ] + } + }, + "required": [ + "vector_string", + "score" + ], + "additionalProperties": false + }, + "cwes": { + "type": "array", + "items": { + "type": "object", + "properties": { + "cwe_id": { + "type": "string" + }, + "name": { + "type": "string" + } + }, + "required": [ + "cwe_id", + "name" + ], + "additionalProperties": false + } + }, + "published_at": { + "type": "string", + "format": "date-time" + }, + "updated_at": { + "type": "string", + "format": "date-time" + }, + "vulnerabilities": { + "type": "array", + "items": { + "type": "object", + "properties": { + "first_patched_version": { + "type": [ + "object", + "null" + ], + "properties": { + "identifier": { + "type": "string" + } + }, + "required": [ + "identifier" + ], + "additionalProperties": false + }, + "package": { + "type": "object", + "properties": { + "ecosystem": { + "type": "string" + }, + "name": { + "type": "string" + } + }, + "required": [ + "ecosystem", + "name" + ], + "additionalProperties": false + }, + "severity": { + "type": "string" + }, + "vulnerable_version_range": { + "type": "string" + } + }, + "required": [ + "package", + "severity", + "vulnerable_version_range", + "first_patched_version" + ], + "additionalProperties": false + } + }, + "withdrawn_at": { + "type": [ + "string", + "null" + ], + "format": "date-time" + } + }, + "required": [ + "cvss", + "cwes", + "ghsa_id", + "summary", + "description", + "severity", + "identifiers", + "references", + "published_at", + "updated_at", + "withdrawn_at", + "vulnerabilities" + ], + "additionalProperties": false + }, + "security_vulnerability": { + "type": "object", + "description": "The details of the vulnerability of a security advisory.", + "readOnly": true, + "properties": { + "package": { + "type": "object", + "description": "The details of the vulnerable package.", + "readOnly": true, + "properties": { + "ecosystem": { + "type": "string" + }, + "name": { + "type": "string" + } + } + }, + "severity": { + "type": "string" + }, + "vulnerable_version_range": { + "type": "string" + }, + "first_patched_version": { + "type": "object", + "properties": { + "identifier": { + "type": "string" + } + } + } + } + }, + "created_at": { + "type": "string", + "description": "The time that the alert was created in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.", + "format": "date-time", + "readOnly": true + }, + "updated_at": { + "type": "string", + "description": "The time that the alert was last updated in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.", + "format": "date-time", + "readOnly": true + }, + "url": { + "type": "string", + "description": "The REST API URL of the alert resource.", + "format": "uri", + "readOnly": true + }, + "html_url": { + "type": "string", + "description": "The GitHub URL of the alert resource.", + "format": "uri", + "readOnly": true + }, + "dismissed_at": { + "type": [ + "string", + "null" + ], + "description": "The time that the alert was dismissed in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.", + "format": "date-time", + "readOnly": true + }, + "dismissed_by": { + "anyOf": [ + { + "type": "null" + }, + { + "title": "Simple User", + "description": "Simple User", + "type": "object", + "properties": { + "name": { + "type": [ + "string", + "null" + ] + }, + "email": { + "type": [ + "string", + "null" + ] + }, + "login": { + "type": "string", + "examples": [ + "octocat" + ] + }, + "id": { + "type": "integer", + "examples": [ + 1 + ] + }, + "node_id": { + "type": "string", + "examples": [ + "MDQ6VXNlcjE=" + ] + }, + "avatar_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://github.com/images/error/octocat_happy.gif" + ] + }, + "gravatar_id": { + "type": [ + "string", + "null" + ], + "examples": [ + "41d064eb2195891e12d0413f63227ea7" + ] + }, + "url": { + "type": "string", + "format": "uri", + "examples": [ + "https://api.github.com/users/octocat" + ] + }, + "html_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://github.com/octocat" + ] + }, + "followers_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://api.github.com/users/octocat/followers" + ] + }, + "following_url": { + "type": "string", + "examples": [ + "https://api.github.com/users/octocat/following{/other_user}" + ] + }, + "gists_url": { + "type": "string", + "examples": [ + "https://api.github.com/users/octocat/gists{/gist_id}" + ] + }, + "starred_url": { + "type": "string", + "examples": [ + "https://api.github.com/users/octocat/starred{/owner}{/repo}" + ] + }, + "subscriptions_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://api.github.com/users/octocat/subscriptions" + ] + }, + "organizations_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://api.github.com/users/octocat/orgs" + ] + }, + "repos_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://api.github.com/users/octocat/repos" + ] + }, + "events_url": { + "type": "string", + "examples": [ + "https://api.github.com/users/octocat/events{/privacy}" + ] + }, + "received_events_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://api.github.com/users/octocat/received_events" + ] + }, + "type": { + "type": "string", + "examples": [ + "User" + ] + }, + "site_admin": { + "type": "boolean" + }, + "starred_at": { + "type": "string", + "examples": [ + "\"2020-07-09T00:17:55Z\"" + ] + } + }, + "required": [ + "avatar_url", + "events_url", + "followers_url", + "following_url", + "gists_url", + "gravatar_id", + "html_url", + "id", + "node_id", + "login", + "organizations_url", + "received_events_url", + "repos_url", + "site_admin", + "starred_url", + "subscriptions_url", + "type", + "url" + ] + } + ] + }, + "dismissed_reason": { + "type": [ + "string", + "null" + ], + "description": "**Required when the `state` is `dismissed`.** The reason for dismissing the Dependabot alert.", + "enum": [ + "fix_started", + "inaccurate", + "no_bandwidth", + "not_used", + "tolerable_risk", + null + ] + }, + "dismissed_comment": { + "type": [ + "string", + "null" + ], + "description": "An optional comment associated with the alert's dismissal. The maximum size is 280 characters.", + "maxLength": 280 + }, + "fixed_at": { + "type": [ + "string", + "null" + ], + "description": "The time that the alert was no longer detected and was considered fixed in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.", + "format": "date-time", + "readOnly": true + } + }, + "required": [ + "number", + "state", + "dependency", + "security_advisory", + "security_vulnerability", + "url", + "html_url", + "dismissed_at", + "dismissed_by", + "dismissed_reason", + "dismissed_comment", + "fixed_at", + "created_at", + "updated_at" + ] + }, + "examples": { + "default": { + "value": { + "number": 2, + "state": "dismissed", + "dependency": { + "package": { + "ecosystem": "pip", + "name": "django" + }, + "manifest_path": "path/to/requirements.txt", + "scope": "runtime" + }, + "security_advisory": { + "ghsa_id": "GHSA-rf4j-j272-fj86", + "cve_id": "CVE-2018-6188", + "summary": "Django allows remote attackers to obtain potentially sensitive information by leveraging data exposure from the confirm_login_allowed() method, as demonstrated by discovering whether a user account is inactive", + "description": "django.contrib.auth.forms.AuthenticationForm in Django 2.0 before 2.0.2, and 1.11.8 and 1.11.9, allows remote attackers to obtain potentially sensitive information by leveraging data exposure from the confirm_login_allowed() method, as demonstrated by discovering whether a user account is inactive.", + "severity": "high", + "identifiers": [ + { + "type": "GHSA", + "value": "GHSA-rf4j-j272-fj86" + }, + { + "type": "CVE", + "value": "CVE-2018-6188" + } + ], + "references": [ + { + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-6188" + }, + { + "url": "https://github.com/advisories/GHSA-rf4j-j272-fj86" + }, + { + "url": "https://usn.ubuntu.com/3559-1/" + }, + { + "url": "https://www.djangoproject.com/weblog/2018/feb/01/security-releases/" + }, + { + "url": "http://www.securitytracker.com/id/1040422" + } + ], + "published_at": "2018-10-03T21:13:54Z", + "updated_at": "2022-04-26T18:35:37Z", + "withdrawn_at": null, + "vulnerabilities": [ + { + "package": { + "ecosystem": "pip", + "name": "django" + }, + "severity": "high", + "vulnerable_version_range": ">= 2.0.0, < 2.0.2", + "first_patched_version": { + "identifier": "2.0.2" + } + }, + { + "package": { + "ecosystem": "pip", + "name": "django" + }, + "severity": "high", + "vulnerable_version_range": ">= 1.11.8, < 1.11.10", + "first_patched_version": { + "identifier": "1.11.10" + } + } + ], + "cvss": { + "vector_string": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", + "score": 7.5 + }, + "cwes": [ + { + "cwe_id": "CWE-200", + "name": "Exposure of Sensitive Information to an Unauthorized Actor" + } + ] + }, + "security_vulnerability": { + "package": { + "ecosystem": "pip", + "name": "django" + }, + "severity": "high", + "vulnerable_version_range": ">= 2.0.0, < 2.0.2", + "first_patched_version": { + "identifier": "2.0.2" + } + }, + "url": "https://api.github.com/repos/octocat/hello-world/dependabot/alerts/2", + "html_url": "https://github.com/octocat/hello-world/security/dependabot/2", + "created_at": "2022-06-15T07:43:03Z", + "updated_at": "2022-08-23T14:29:47Z", + "dismissed_at": "2022-08-23T14:29:47Z", + "dismissed_by": { + "login": "octocat", + "id": 1, + "node_id": "MDQ6VXNlcjE=", + "avatar_url": "https://github.com/images/error/octocat_happy.gif", + "gravatar_id": "", + "url": "https://api.github.com/users/octocat", + "html_url": "https://github.com/octocat", + "followers_url": "https://api.github.com/users/octocat/followers", + "following_url": "https://api.github.com/users/octocat/following{/other_user}", + "gists_url": "https://api.github.com/users/octocat/gists{/gist_id}", + "starred_url": "https://api.github.com/users/octocat/starred{/owner}{/repo}", + "subscriptions_url": "https://api.github.com/users/octocat/subscriptions", + "organizations_url": "https://api.github.com/users/octocat/orgs", + "repos_url": "https://api.github.com/users/octocat/repos", + "events_url": "https://api.github.com/users/octocat/events{/privacy}", + "received_events_url": "https://api.github.com/users/octocat/received_events", + "type": "User", + "site_admin": false + }, + "dismissed_reason": "tolerable_risk", + "dismissed_comment": "This alert is accurate but we use a sanitizer.", + "fixed_at": null + } + } + } + } + } + }, + "304": { + "description": "Not modified" + }, + "400": { + "description": "Bad Request", + "content": { + "application/json": { + "schema": { + "title": "Basic Error", + "description": "Basic Error", + "type": "object", + "properties": { + "message": { + "type": "string" + }, + "documentation_url": { + "type": "string" + }, + "url": { + "type": "string" + }, + "status": { + "type": "string" + } + } + } + }, + "application/scim+json": { + "schema": { + "title": "Scim Error", + "description": "Scim Error", + "type": "object", + "properties": { + "message": { + "type": [ + "string", + "null" + ] + }, + "documentation_url": { + "type": [ + "string", + "null" + ] + }, + "detail": { + "type": [ + "string", + "null" + ] + }, + "status": { + "type": "integer" + }, + "scimType": { + "type": [ + "string", + "null" + ] + }, + "schemas": { + "type": "array", + "items": { + "type": "string" + } + } + } + } + } + } + }, + "403": { + "description": "Forbidden", + "content": { + "application/json": { + "schema": { + "title": "Basic Error", + "description": "Basic Error", + "type": "object", + "properties": { + "message": { + "type": "string" + }, + "documentation_url": { + "type": "string" + }, + "url": { + "type": "string" + }, + "status": { + "type": "string" + } + } + } + } + } + }, + "404": { + "description": "Resource not found", + "content": { + "application/json": { + "schema": { + "title": "Basic Error", + "description": "Basic Error", + "type": "object", + "properties": { + "message": { + "type": "string" + }, + "documentation_url": { + "type": "string" + }, + "url": { + "type": "string" + }, + "status": { + "type": "string" + } + } + } + } + } + }, + "409": { + "description": "Conflict", + "content": { + "application/json": { + "schema": { + "title": "Basic Error", + "description": "Basic Error", + "type": "object", + "properties": { + "message": { + "type": "string" + }, + "documentation_url": { + "type": "string" + }, + "url": { + "type": "string" + }, + "status": { + "type": "string" + } + } + } + } + } + }, + "422": { + "description": "Validation failed", + "content": { + "application/json": { + "schema": { + "title": "Validation Error Simple", + "description": "Validation Error Simple", + "type": "object", + "required": [ + "message", + "documentation_url" + ], + "properties": { + "message": { + "type": "string" + }, + "documentation_url": { + "type": "string" + }, + "errors": { + "type": "array", + "items": { + "type": "string" + } + } + } + } + } + } + } + }, + "x-github": { + "githubCloudOnly": false, + "enabledForGitHubApps": true, + "previews": [ + + ], + "category": "dependabot", + "subcategory": "alerts" + } + } + }, "/repos/{owner}/{repo}/dependabot/secrets": { "get": { "summary": "List repository secrets", diff --git a/lib/rest/static/dereferenced/ghec.deref.json b/lib/rest/static/dereferenced/ghec.deref.json index 755c91f2cf..a49aa2d8ec 100644 --- a/lib/rest/static/dereferenced/ghec.deref.json +++ b/lib/rest/static/dereferenced/ghec.deref.json @@ -289514,6 +289514,2725 @@ } } }, + "/repos/{owner}/{repo}/dependabot/alerts": { + "get": { + "summary": "List Dependabot alerts for a repository", + "description": "You must use an access token with the `security_events` scope to use this endpoint with private repositories.\nYou can also use tokens with the `public_repo` scope for public repositories only.\nGitHub Apps must have **Dependabot alerts** read permission to use this endpoint.", + "tags": [ + "dependabot" + ], + "operationId": "dependabot/list-alerts-for-repo", + "externalDocs": { + "description": "API method documentation", + "url": "https://docs.github.com/enterprise-cloud@latest//rest/reference/dependabot#list-dependabot-alerts-for-a-repository" + }, + "parameters": [ + { + "name": "owner", + "description": "The account owner of the repository. The name is not case sensitive.", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + }, + { + "name": "repo", + "description": "The name of the repository. The name is not case sensitive.", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + }, + { + "name": "state", + "description": "A comma-separated list of states. If specified, only alerts with these states will be returned.\n\nCan be: `dismissed`, `fixed`, `open`", + "in": "query", + "schema": { + "type": "string" + } + }, + { + "name": "severity", + "description": "A comma-separated list of severities. If specified, only alerts with these severities will be returned.\n\nCan be: `low`, `medium`, `high`, `critical`", + "in": "query", + "schema": { + "type": "string" + } + }, + { + "name": "ecosystem", + "description": "A comma-separated list of ecosystems. If specified, only alerts for these ecosystems will be returned.\n\nCan be: `composer`, `go`, `maven`, `npm`, `nuget`, `pip`, `rubygems`, `rust`", + "in": "query", + "schema": { + "type": "string" + } + }, + { + "name": "package", + "description": "A comma-separated list of package names. If specified, only alerts for these packages will be returned.", + "in": "query", + "schema": { + "type": "string" + } + }, + { + "name": "manifest", + "description": "A comma-separated list of full manifest paths. If specified, only alerts for these manifests will be returned.", + "in": "query", + "schema": { + "type": "string" + } + }, + { + "name": "scope", + "description": "Scope of the dependency on a Dependabot alert.", + "in": "query", + "schema": { + "type": [ + "string", + "null" + ], + "description": "The scope of the vulnerable dependency.", + "readOnly": true, + "enum": [ + "development", + "runtime", + null + ] + } + }, + { + "name": "sort", + "description": "The property by which to sort the results.\n`created` means when the alert was created.\n`updated` means when the alert's state last changed.", + "in": "query", + "required": false, + "schema": { + "type": "string", + "enum": [ + "created", + "updated" + ], + "default": "created" + } + }, + { + "name": "direction", + "description": "The direction to sort the results by.", + "in": "query", + "required": false, + "schema": { + "type": "string", + "enum": [ + "asc", + "desc" + ], + "default": "desc" + } + }, + { + "name": "page", + "description": "Page number of the results to fetch.", + "in": "query", + "schema": { + "type": "integer", + "default": 1 + } + }, + { + "name": "per_page", + "description": "The number of results per page (max 100).", + "in": "query", + "schema": { + "type": "integer", + "default": 30 + } + } + ], + "responses": { + "200": { + "description": "Response", + "content": { + "application/json": { + "schema": { + "type": "array", + "items": { + "type": "object", + "properties": { + "number": { + "type": "integer", + "description": "The security alert number.", + "readOnly": true + }, + "state": { + "type": "string", + "description": "State of a Dependabot alert.", + "enum": [ + "dismissed", + "fixed", + "open" + ] + }, + "dependency": { + "type": "object", + "readOnly": true, + "properties": { + "package": { + "type": "object", + "description": "The details of the vulnerable package.", + "readOnly": true, + "properties": { + "ecosystem": { + "type": "string" + }, + "name": { + "type": "string" + } + } + }, + "manifest_path": { + "type": "string", + "description": "The path to the manifest filename.", + "readOnly": true + }, + "scope": { + "type": [ + "string", + "null" + ], + "description": "The scope of the vulnerable dependency.", + "readOnly": true, + "enum": [ + "development", + "runtime", + null + ] + } + } + }, + "security_advisory": { + "type": "object", + "description": "The details of the security advisory, including summary, description, and severity.", + "readOnly": true, + "properties": { + "ghsa_id": { + "type": "string" + }, + "cve_id": { + "type": [ + "string", + "null" + ] + }, + "summary": { + "type": "string" + }, + "description": { + "type": "string" + }, + "severity": { + "type": "string", + "enum": [ + "low", + "medium", + "high", + "critical" + ] + }, + "identifiers": { + "type": "array", + "items": { + "type": "object", + "properties": { + "type": { + "type": "string", + "enum": [ + "GHSA", + "CVE" + ] + }, + "value": { + "type": "string" + } + }, + "required": [ + "value", + "type" + ], + "additionalProperties": false + } + }, + "references": { + "type": "array", + "items": { + "type": "object", + "properties": { + "url": { + "type": "string", + "format": "uri" + } + }, + "required": [ + "url" + ], + "additionalProperties": false + } + }, + "cvss": { + "type": "object", + "properties": { + "score": { + "type": "number" + }, + "vector_string": { + "type": [ + "string", + "null" + ] + } + }, + "required": [ + "vector_string", + "score" + ], + "additionalProperties": false + }, + "cwes": { + "type": "array", + "items": { + "type": "object", + "properties": { + "cwe_id": { + "type": "string" + }, + "name": { + "type": "string" + } + }, + "required": [ + "cwe_id", + "name" + ], + "additionalProperties": false + } + }, + "published_at": { + "type": "string", + "format": "date-time" + }, + "updated_at": { + "type": "string", + "format": "date-time" + }, + "vulnerabilities": { + "type": "array", + "items": { + "type": "object", + "properties": { + "first_patched_version": { + "type": [ + "object", + "null" + ], + "properties": { + "identifier": { + "type": "string" + } + }, + "required": [ + "identifier" + ], + "additionalProperties": false + }, + "package": { + "type": "object", + "properties": { + "ecosystem": { + "type": "string" + }, + "name": { + "type": "string" + } + }, + "required": [ + "ecosystem", + "name" + ], + "additionalProperties": false + }, + "severity": { + "type": "string" + }, + "vulnerable_version_range": { + "type": "string" + } + }, + "required": [ + "package", + "severity", + "vulnerable_version_range", + "first_patched_version" + ], + "additionalProperties": false + } + }, + "withdrawn_at": { + "type": [ + "string", + "null" + ], + "format": "date-time" + } + }, + "required": [ + "cvss", + "cwes", + "ghsa_id", + "summary", + "description", + "severity", + "identifiers", + "references", + "published_at", + "updated_at", + "withdrawn_at", + "vulnerabilities" + ], + "additionalProperties": false + }, + "security_vulnerability": { + "type": "object", + "description": "The details of the vulnerability of a security advisory.", + "readOnly": true, + "properties": { + "package": { + "type": "object", + "description": "The details of the vulnerable package.", + "readOnly": true, + "properties": { + "ecosystem": { + "type": "string" + }, + "name": { + "type": "string" + } + } + }, + "severity": { + "type": "string" + }, + "vulnerable_version_range": { + "type": "string" + }, + "first_patched_version": { + "type": "object", + "properties": { + "identifier": { + "type": "string" + } + } + } + } + }, + "created_at": { + "type": "string", + "description": "The time that the alert was created in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.", + "format": "date-time", + "readOnly": true + }, + "updated_at": { + "type": "string", + "description": "The time that the alert was last updated in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.", + "format": "date-time", + "readOnly": true + }, + "url": { + "type": "string", + "description": "The REST API URL of the alert resource.", + "format": "uri", + "readOnly": true + }, + "html_url": { + "type": "string", + "description": "The GitHub URL of the alert resource.", + "format": "uri", + "readOnly": true + }, + "dismissed_at": { + "type": [ + "string", + "null" + ], + "description": "The time that the alert was dismissed in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.", + "format": "date-time", + "readOnly": true + }, + "dismissed_by": { + "anyOf": [ + { + "type": "null" + }, + { + "title": "Simple User", + "description": "Simple User", + "type": "object", + "properties": { + "name": { + "type": [ + "string", + "null" + ] + }, + "email": { + "type": [ + "string", + "null" + ] + }, + "login": { + "type": "string", + "examples": [ + "octocat" + ] + }, + "id": { + "type": "integer", + "examples": [ + 1 + ] + }, + "node_id": { + "type": "string", + "examples": [ + "MDQ6VXNlcjE=" + ] + }, + "avatar_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://github.com/images/error/octocat_happy.gif" + ] + }, + "gravatar_id": { + "type": [ + "string", + "null" + ], + "examples": [ + "41d064eb2195891e12d0413f63227ea7" + ] + }, + "url": { + "type": "string", + "format": "uri", + "examples": [ + "https://api.github.com/users/octocat" + ] + }, + "html_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://github.com/octocat" + ] + }, + "followers_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://api.github.com/users/octocat/followers" + ] + }, + "following_url": { + "type": "string", + "examples": [ + "https://api.github.com/users/octocat/following{/other_user}" + ] + }, + "gists_url": { + "type": "string", + "examples": [ + "https://api.github.com/users/octocat/gists{/gist_id}" + ] + }, + "starred_url": { + "type": "string", + "examples": [ + "https://api.github.com/users/octocat/starred{/owner}{/repo}" + ] + }, + "subscriptions_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://api.github.com/users/octocat/subscriptions" + ] + }, + "organizations_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://api.github.com/users/octocat/orgs" + ] + }, + "repos_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://api.github.com/users/octocat/repos" + ] + }, + "events_url": { + "type": "string", + "examples": [ + "https://api.github.com/users/octocat/events{/privacy}" + ] + }, + "received_events_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://api.github.com/users/octocat/received_events" + ] + }, + "type": { + "type": "string", + "examples": [ + "User" + ] + }, + "site_admin": { + "type": "boolean" + }, + "starred_at": { + "type": "string", + "examples": [ + "\"2020-07-09T00:17:55Z\"" + ] + } + }, + "required": [ + "avatar_url", + "events_url", + "followers_url", + "following_url", + "gists_url", + "gravatar_id", + "html_url", + "id", + "node_id", + "login", + "organizations_url", + "received_events_url", + "repos_url", + "site_admin", + "starred_url", + "subscriptions_url", + "type", + "url" + ] + } + ] + }, + "dismissed_reason": { + "type": [ + "string", + "null" + ], + "description": "**Required when the `state` is `dismissed`.** The reason for dismissing the Dependabot alert.", + "enum": [ + "fix_started", + "inaccurate", + "no_bandwidth", + "not_used", + "tolerable_risk", + null + ] + }, + "dismissed_comment": { + "type": [ + "string", + "null" + ], + "description": "An optional comment associated with the alert's dismissal. The maximum size is 280 characters.", + "maxLength": 280 + }, + "fixed_at": { + "type": [ + "string", + "null" + ], + "description": "The time that the alert was no longer detected and was considered fixed in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.", + "format": "date-time", + "readOnly": true + } + }, + "required": [ + "number", + "state", + "dependency", + "security_advisory", + "security_vulnerability", + "url", + "html_url", + "dismissed_at", + "dismissed_by", + "dismissed_reason", + "dismissed_comment", + "fixed_at", + "created_at", + "updated_at" + ] + } + }, + "examples": { + "default": { + "value": [ + { + "number": 2, + "state": "dismissed", + "dependency": { + "package": { + "ecosystem": "pip", + "name": "django" + }, + "manifest_path": "path/to/requirements.txt", + "scope": "runtime" + }, + "security_advisory": { + "ghsa_id": "GHSA-rf4j-j272-fj86", + "cve_id": "CVE-2018-6188", + "summary": "Django allows remote attackers to obtain potentially sensitive information by leveraging data exposure from the confirm_login_allowed() method, as demonstrated by discovering whether a user account is inactive", + "description": "django.contrib.auth.forms.AuthenticationForm in Django 2.0 before 2.0.2, and 1.11.8 and 1.11.9, allows remote attackers to obtain potentially sensitive information by leveraging data exposure from the confirm_login_allowed() method, as demonstrated by discovering whether a user account is inactive.", + "severity": "high", + "identifiers": [ + { + "type": "GHSA", + "value": "GHSA-rf4j-j272-fj86" + }, + { + "type": "CVE", + "value": "CVE-2018-6188" + } + ], + "references": [ + { + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-6188" + }, + { + "url": "https://github.com/advisories/GHSA-rf4j-j272-fj86" + }, + { + "url": "https://usn.ubuntu.com/3559-1/" + }, + { + "url": "https://www.djangoproject.com/weblog/2018/feb/01/security-releases/" + }, + { + "url": "http://www.securitytracker.com/id/1040422" + } + ], + "published_at": "2018-10-03T21:13:54Z", + "updated_at": "2022-04-26T18:35:37Z", + "withdrawn_at": null, + "vulnerabilities": [ + { + "package": { + "ecosystem": "pip", + "name": "django" + }, + "severity": "high", + "vulnerable_version_range": ">= 2.0.0, < 2.0.2", + "first_patched_version": { + "identifier": "2.0.2" + } + }, + { + "package": { + "ecosystem": "pip", + "name": "django" + }, + "severity": "high", + "vulnerable_version_range": ">= 1.11.8, < 1.11.10", + "first_patched_version": { + "identifier": "1.11.10" + } + } + ], + "cvss": { + "vector_string": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", + "score": 7.5 + }, + "cwes": [ + { + "cwe_id": "CWE-200", + "name": "Exposure of Sensitive Information to an Unauthorized Actor" + } + ] + }, + "security_vulnerability": { + "package": { + "ecosystem": "pip", + "name": "django" + }, + "severity": "high", + "vulnerable_version_range": ">= 2.0.0, < 2.0.2", + "first_patched_version": { + "identifier": "2.0.2" + } + }, + "url": "https://api.github.com/repos/octocat/hello-world/dependabot/alerts/2", + "html_url": "https://github.com/octocat/hello-world/security/dependabot/2", + "created_at": "2022-06-15T07:43:03Z", + "updated_at": "2022-08-23T14:29:47Z", + "dismissed_at": "2022-08-23T14:29:47Z", + "dismissed_by": { + "login": "octocat", + "id": 1, + "node_id": "MDQ6VXNlcjE=", + "avatar_url": "https://github.com/images/error/octocat_happy.gif", + "gravatar_id": "", + "url": "https://api.github.com/users/octocat", + "html_url": "https://github.com/octocat", + "followers_url": "https://api.github.com/users/octocat/followers", + "following_url": "https://api.github.com/users/octocat/following{/other_user}", + "gists_url": "https://api.github.com/users/octocat/gists{/gist_id}", + "starred_url": "https://api.github.com/users/octocat/starred{/owner}{/repo}", + "subscriptions_url": "https://api.github.com/users/octocat/subscriptions", + "organizations_url": "https://api.github.com/users/octocat/orgs", + "repos_url": "https://api.github.com/users/octocat/repos", + "events_url": "https://api.github.com/users/octocat/events{/privacy}", + "received_events_url": "https://api.github.com/users/octocat/received_events", + "type": "User", + "site_admin": false + }, + "dismissed_reason": "tolerable_risk", + "dismissed_comment": "This alert is accurate but we use a sanitizer.", + "fixed_at": null + }, + { + "number": 1, + "state": "open", + "dependency": { + "package": { + "ecosystem": "pip", + "name": "ansible" + }, + "manifest_path": "path/to/requirements.txt", + "scope": "runtime" + }, + "security_advisory": { + "ghsa_id": "GHSA-8f4m-hccc-8qph", + "cve_id": "CVE-2021-20191", + "summary": "Insertion of Sensitive Information into Log File in ansible", + "description": "A flaw was found in ansible. Credentials, such as secrets, are being disclosed in console log by default and not protected by no_log feature when using those modules. An attacker can take advantage of this information to steal those credentials. The highest threat from this vulnerability is to data confidentiality.", + "severity": "medium", + "identifiers": [ + { + "type": "GHSA", + "value": "GHSA-8f4m-hccc-8qph" + }, + { + "type": "CVE", + "value": "CVE-2021-20191" + } + ], + "references": [ + { + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20191" + }, + { + "url": "https://access.redhat.com/security/cve/cve-2021-20191" + }, + { + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1916813" + } + ], + "published_at": "2021-06-01T17:38:00Z", + "updated_at": "2021-08-12T23:06:00Z", + "withdrawn_at": null, + "vulnerabilities": [ + { + "package": { + "ecosystem": "pip", + "name": "ansible" + }, + "severity": "medium", + "vulnerable_version_range": ">= 2.9.0, < 2.9.18", + "first_patched_version": { + "identifier": "2.9.18" + } + }, + { + "package": { + "ecosystem": "pip", + "name": "ansible" + }, + "severity": "medium", + "vulnerable_version_range": "< 2.8.19", + "first_patched_version": { + "identifier": "2.8.19" + } + }, + { + "package": { + "ecosystem": "pip", + "name": "ansible" + }, + "severity": "medium", + "vulnerable_version_range": ">= 2.10.0, < 2.10.7", + "first_patched_version": { + "identifier": "2.10.7" + } + } + ], + "cvss": { + "vector_string": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", + "score": 5.5 + }, + "cwes": [ + { + "cwe_id": "CWE-532", + "name": "Insertion of Sensitive Information into Log File" + } + ] + }, + "security_vulnerability": { + "package": { + "ecosystem": "pip", + "name": "ansible" + }, + "severity": "medium", + "vulnerable_version_range": "< 2.8.19", + "first_patched_version": { + "identifier": "2.8.19" + } + }, + "url": "https://api.github.com/repos/octocat/hello-world/dependabot/alerts/1", + "html_url": "https://github.com/octocat/hello-world/security/dependabot/1", + "created_at": "2022-06-14T15:21:52Z", + "updated_at": "2022-06-14T15:21:52Z", + "dismissed_at": null, + "dismissed_by": null, + "dismissed_reason": null, + "dismissed_comment": null, + "fixed_at": null + } + ] + } + } + } + } + }, + "304": { + "description": "Not modified" + }, + "403": { + "description": "Forbidden", + "content": { + "application/json": { + "schema": { + "title": "Basic Error", + "description": "Basic Error", + "type": "object", + "properties": { + "message": { + "type": "string" + }, + "documentation_url": { + "type": "string" + }, + "url": { + "type": "string" + }, + "status": { + "type": "string" + } + } + } + } + } + }, + "404": { + "description": "Resource not found", + "content": { + "application/json": { + "schema": { + "title": "Basic Error", + "description": "Basic Error", + "type": "object", + "properties": { + "message": { + "type": "string" + }, + "documentation_url": { + "type": "string" + }, + "url": { + "type": "string" + }, + "status": { + "type": "string" + } + } + } + } + } + }, + "422": { + "description": "Validation failed", + "content": { + "application/json": { + "schema": { + "title": "Validation Error Simple", + "description": "Validation Error Simple", + "type": "object", + "required": [ + "message", + "documentation_url" + ], + "properties": { + "message": { + "type": "string" + }, + "documentation_url": { + "type": "string" + }, + "errors": { + "type": "array", + "items": { + "type": "string" + } + } + } + } + } + } + } + }, + "x-github": { + "githubCloudOnly": false, + "enabledForGitHubApps": true, + "previews": [ + + ], + "category": "dependabot", + "subcategory": "alerts" + } + } + }, + "/repos/{owner}/{repo}/dependabot/alerts/{alert_number}": { + "get": { + "summary": "Get a Dependabot alert", + "description": "You must use an access token with the `security_events` scope to use this endpoint with private repositories.\nYou can also use tokens with the `public_repo` scope for public repositories only.\nGitHub Apps must have **Dependabot alerts** read permission to use this endpoint.", + "tags": [ + "dependabot" + ], + "operationId": "dependabot/get-alert", + "externalDocs": { + "description": "API method documentation", + "url": "https://docs.github.com/enterprise-cloud@latest//rest/reference/dependabot#get-a-dependabot-alert" + }, + "parameters": [ + { + "name": "owner", + "description": "The account owner of the repository. The name is not case sensitive.", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + }, + { + "name": "repo", + "description": "The name of the repository. The name is not case sensitive.", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + }, + { + "name": "alert_number", + "in": "path", + "description": "The number that identifies a Dependabot alert in its repository. You can find this at the end of the URL for a Dependabot alert within GitHub, or in `number` fields in the response from the `GET /repos/{owner}/{repo}/dependabot/alerts` operation.", + "required": true, + "schema": { + "type": "integer", + "description": "The security alert number.", + "readOnly": true + } + } + ], + "responses": { + "200": { + "description": "Response", + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "number": { + "type": "integer", + "description": "The security alert number.", + "readOnly": true + }, + "state": { + "type": "string", + "description": "State of a Dependabot alert.", + "enum": [ + "dismissed", + "fixed", + "open" + ] + }, + "dependency": { + "type": "object", + "readOnly": true, + "properties": { + "package": { + "type": "object", + "description": "The details of the vulnerable package.", + "readOnly": true, + "properties": { + "ecosystem": { + "type": "string" + }, + "name": { + "type": "string" + } + } + }, + "manifest_path": { + "type": "string", + "description": "The path to the manifest filename.", + "readOnly": true + }, + "scope": { + "type": [ + "string", + "null" + ], + "description": "The scope of the vulnerable dependency.", + "readOnly": true, + "enum": [ + "development", + "runtime", + null + ] + } + } + }, + "security_advisory": { + "type": "object", + "description": "The details of the security advisory, including summary, description, and severity.", + "readOnly": true, + "properties": { + "ghsa_id": { + "type": "string" + }, + "cve_id": { + "type": [ + "string", + "null" + ] + }, + "summary": { + "type": "string" + }, + "description": { + "type": "string" + }, + "severity": { + "type": "string", + "enum": [ + "low", + "medium", + "high", + "critical" + ] + }, + "identifiers": { + "type": "array", + "items": { + "type": "object", + "properties": { + "type": { + "type": "string", + "enum": [ + "GHSA", + "CVE" + ] + }, + "value": { + "type": "string" + } + }, + "required": [ + "value", + "type" + ], + "additionalProperties": false + } + }, + "references": { + "type": "array", + "items": { + "type": "object", + "properties": { + "url": { + "type": "string", + "format": "uri" + } + }, + "required": [ + "url" + ], + "additionalProperties": false + } + }, + "cvss": { + "type": "object", + "properties": { + "score": { + "type": "number" + }, + "vector_string": { + "type": [ + "string", + "null" + ] + } + }, + "required": [ + "vector_string", + "score" + ], + "additionalProperties": false + }, + "cwes": { + "type": "array", + "items": { + "type": "object", + "properties": { + "cwe_id": { + "type": "string" + }, + "name": { + "type": "string" + } + }, + "required": [ + "cwe_id", + "name" + ], + "additionalProperties": false + } + }, + "published_at": { + "type": "string", + "format": "date-time" + }, + "updated_at": { + "type": "string", + "format": "date-time" + }, + "vulnerabilities": { + "type": "array", + "items": { + "type": "object", + "properties": { + "first_patched_version": { + "type": [ + "object", + "null" + ], + "properties": { + "identifier": { + "type": "string" + } + }, + "required": [ + "identifier" + ], + "additionalProperties": false + }, + "package": { + "type": "object", + "properties": { + "ecosystem": { + "type": "string" + }, + "name": { + "type": "string" + } + }, + "required": [ + "ecosystem", + "name" + ], + "additionalProperties": false + }, + "severity": { + "type": "string" + }, + "vulnerable_version_range": { + "type": "string" + } + }, + "required": [ + "package", + "severity", + "vulnerable_version_range", + "first_patched_version" + ], + "additionalProperties": false + } + }, + "withdrawn_at": { + "type": [ + "string", + "null" + ], + "format": "date-time" + } + }, + "required": [ + "cvss", + "cwes", + "ghsa_id", + "summary", + "description", + "severity", + "identifiers", + "references", + "published_at", + "updated_at", + "withdrawn_at", + "vulnerabilities" + ], + "additionalProperties": false + }, + "security_vulnerability": { + "type": "object", + "description": "The details of the vulnerability of a security advisory.", + "readOnly": true, + "properties": { + "package": { + "type": "object", + "description": "The details of the vulnerable package.", + "readOnly": true, + "properties": { + "ecosystem": { + "type": "string" + }, + "name": { + "type": "string" + } + } + }, + "severity": { + "type": "string" + }, + "vulnerable_version_range": { + "type": "string" + }, + "first_patched_version": { + "type": "object", + "properties": { + "identifier": { + "type": "string" + } + } + } + } + }, + "created_at": { + "type": "string", + "description": "The time that the alert was created in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.", + "format": "date-time", + "readOnly": true + }, + "updated_at": { + "type": "string", + "description": "The time that the alert was last updated in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.", + "format": "date-time", + "readOnly": true + }, + "url": { + "type": "string", + "description": "The REST API URL of the alert resource.", + "format": "uri", + "readOnly": true + }, + "html_url": { + "type": "string", + "description": "The GitHub URL of the alert resource.", + "format": "uri", + "readOnly": true + }, + "dismissed_at": { + "type": [ + "string", + "null" + ], + "description": "The time that the alert was dismissed in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.", + "format": "date-time", + "readOnly": true + }, + "dismissed_by": { + "anyOf": [ + { + "type": "null" + }, + { + "title": "Simple User", + "description": "Simple User", + "type": "object", + "properties": { + "name": { + "type": [ + "string", + "null" + ] + }, + "email": { + "type": [ + "string", + "null" + ] + }, + "login": { + "type": "string", + "examples": [ + "octocat" + ] + }, + "id": { + "type": "integer", + "examples": [ + 1 + ] + }, + "node_id": { + "type": "string", + "examples": [ + "MDQ6VXNlcjE=" + ] + }, + "avatar_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://github.com/images/error/octocat_happy.gif" + ] + }, + "gravatar_id": { + "type": [ + "string", + "null" + ], + "examples": [ + "41d064eb2195891e12d0413f63227ea7" + ] + }, + "url": { + "type": "string", + "format": "uri", + "examples": [ + "https://api.github.com/users/octocat" + ] + }, + "html_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://github.com/octocat" + ] + }, + "followers_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://api.github.com/users/octocat/followers" + ] + }, + "following_url": { + "type": "string", + "examples": [ + "https://api.github.com/users/octocat/following{/other_user}" + ] + }, + "gists_url": { + "type": "string", + "examples": [ + "https://api.github.com/users/octocat/gists{/gist_id}" + ] + }, + "starred_url": { + "type": "string", + "examples": [ + "https://api.github.com/users/octocat/starred{/owner}{/repo}" + ] + }, + "subscriptions_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://api.github.com/users/octocat/subscriptions" + ] + }, + "organizations_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://api.github.com/users/octocat/orgs" + ] + }, + "repos_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://api.github.com/users/octocat/repos" + ] + }, + "events_url": { + "type": "string", + "examples": [ + "https://api.github.com/users/octocat/events{/privacy}" + ] + }, + "received_events_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://api.github.com/users/octocat/received_events" + ] + }, + "type": { + "type": "string", + "examples": [ + "User" + ] + }, + "site_admin": { + "type": "boolean" + }, + "starred_at": { + "type": "string", + "examples": [ + "\"2020-07-09T00:17:55Z\"" + ] + } + }, + "required": [ + "avatar_url", + "events_url", + "followers_url", + "following_url", + "gists_url", + "gravatar_id", + "html_url", + "id", + "node_id", + "login", + "organizations_url", + "received_events_url", + "repos_url", + "site_admin", + "starred_url", + "subscriptions_url", + "type", + "url" + ] + } + ] + }, + "dismissed_reason": { + "type": [ + "string", + "null" + ], + "description": "**Required when the `state` is `dismissed`.** The reason for dismissing the Dependabot alert.", + "enum": [ + "fix_started", + "inaccurate", + "no_bandwidth", + "not_used", + "tolerable_risk", + null + ] + }, + "dismissed_comment": { + "type": [ + "string", + "null" + ], + "description": "An optional comment associated with the alert's dismissal. The maximum size is 280 characters.", + "maxLength": 280 + }, + "fixed_at": { + "type": [ + "string", + "null" + ], + "description": "The time that the alert was no longer detected and was considered fixed in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.", + "format": "date-time", + "readOnly": true + } + }, + "required": [ + "number", + "state", + "dependency", + "security_advisory", + "security_vulnerability", + "url", + "html_url", + "dismissed_at", + "dismissed_by", + "dismissed_reason", + "dismissed_comment", + "fixed_at", + "created_at", + "updated_at" + ] + }, + "examples": { + "default": { + "value": { + "number": 1, + "state": "open", + "dependency": { + "package": { + "ecosystem": "pip", + "name": "ansible" + }, + "manifest_path": "path/to/requirements.txt", + "scope": "runtime" + }, + "security_advisory": { + "ghsa_id": "GHSA-8f4m-hccc-8qph", + "cve_id": "CVE-2021-20191", + "summary": "Insertion of Sensitive Information into Log File in ansible", + "description": "A flaw was found in ansible. Credentials, such as secrets, are being disclosed in console log by default and not protected by no_log feature when using those modules. An attacker can take advantage of this information to steal those credentials. The highest threat from this vulnerability is to data confidentiality.", + "severity": "medium", + "identifiers": [ + { + "type": "GHSA", + "value": "GHSA-8f4m-hccc-8qph" + }, + { + "type": "CVE", + "value": "CVE-2021-20191" + } + ], + "references": [ + { + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20191" + }, + { + "url": "https://access.redhat.com/security/cve/cve-2021-20191" + }, + { + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1916813" + } + ], + "published_at": "2021-06-01T17:38:00Z", + "updated_at": "2021-08-12T23:06:00Z", + "withdrawn_at": null, + "vulnerabilities": [ + { + "package": { + "ecosystem": "pip", + "name": "ansible" + }, + "severity": "medium", + "vulnerable_version_range": ">= 2.9.0, < 2.9.18", + "first_patched_version": { + "identifier": "2.9.18" + } + }, + { + "package": { + "ecosystem": "pip", + "name": "ansible" + }, + "severity": "medium", + "vulnerable_version_range": "< 2.8.19", + "first_patched_version": { + "identifier": "2.8.19" + } + }, + { + "package": { + "ecosystem": "pip", + "name": "ansible" + }, + "severity": "medium", + "vulnerable_version_range": ">= 2.10.0, < 2.10.7", + "first_patched_version": { + "identifier": "2.10.7" + } + } + ], + "cvss": { + "vector_string": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", + "score": 5.5 + }, + "cwes": [ + { + "cwe_id": "CWE-532", + "name": "Insertion of Sensitive Information into Log File" + } + ] + }, + "security_vulnerability": { + "package": { + "ecosystem": "pip", + "name": "ansible" + }, + "severity": "medium", + "vulnerable_version_range": "< 2.8.19", + "first_patched_version": { + "identifier": "2.8.19" + } + }, + "url": "https://api.github.com/repos/octocat/hello-world/dependabot/alerts/1", + "html_url": "https://github.com/octocat/hello-world/security/dependabot/1", + "created_at": "2022-06-14T15:21:52Z", + "updated_at": "2022-06-14T15:21:52Z", + "dismissed_at": null, + "dismissed_by": null, + "dismissed_reason": null, + "dismissed_comment": null, + "fixed_at": null + } + } + } + } + } + }, + "304": { + "description": "Not modified" + }, + "403": { + "description": "Forbidden", + "content": { + "application/json": { + "schema": { + "title": "Basic Error", + "description": "Basic Error", + "type": "object", + "properties": { + "message": { + "type": "string" + }, + "documentation_url": { + "type": "string" + }, + "url": { + "type": "string" + }, + "status": { + "type": "string" + } + } + } + } + } + }, + "404": { + "description": "Resource not found", + "content": { + "application/json": { + "schema": { + "title": "Basic Error", + "description": "Basic Error", + "type": "object", + "properties": { + "message": { + "type": "string" + }, + "documentation_url": { + "type": "string" + }, + "url": { + "type": "string" + }, + "status": { + "type": "string" + } + } + } + } + } + } + }, + "x-github": { + "githubCloudOnly": false, + "enabledForGitHubApps": true, + "previews": [ + + ], + "category": "dependabot", + "subcategory": "alerts" + } + }, + "patch": { + "summary": "Update a Dependabot alert", + "description": "You must use an access token with the `security_events` scope to use this endpoint with private repositories.\nYou can also use tokens with the `public_repo` scope for public repositories only.\nGitHub Apps must have **Dependabot alerts** write permission to use this endpoint.", + "tags": [ + "dependabot" + ], + "operationId": "dependabot/update-alert", + "externalDocs": { + "description": "API method documentation", + "url": "https://docs.github.com/enterprise-cloud@latest//rest/reference/dependabot#update-a-dependabot-alert" + }, + "parameters": [ + { + "name": "owner", + "description": "The account owner of the repository. The name is not case sensitive.", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + }, + { + "name": "repo", + "description": "The name of the repository. The name is not case sensitive.", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + }, + { + "name": "alert_number", + "in": "path", + "description": "The number that identifies a Dependabot alert in its repository. You can find this at the end of the URL for a Dependabot alert within GitHub, or in `number` fields in the response from the `GET /repos/{owner}/{repo}/dependabot/alerts` operation.", + "required": true, + "schema": { + "type": "integer", + "description": "The security alert number.", + "readOnly": true + } + } + ], + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "state": { + "description": "Sets the status of the dependabot alert. You must provide `dismissed_reason` when you set the state to `dismissed`.", + "type": "string", + "enum": [ + "dismissed", + "open" + ] + }, + "dismissed_reason": { + "type": [ + "string", + "null" + ], + "description": "**Required when the `state` is `dismissed`.** The reason for dismissing the Dependabot alert.", + "enum": [ + "fix_started", + "inaccurate", + "no_bandwidth", + "not_used", + "tolerable_risk", + null + ] + }, + "dismissed_comment": { + "type": [ + "string", + "null" + ], + "description": "An optional comment associated with the alert's dismissal. The maximum size is 280 characters.", + "maxLength": 280 + } + }, + "required": [ + "state" + ], + "additionalProperties": false + }, + "examples": { + "default": { + "value": { + "state": "dismissed", + "dismissed_reason": "tolerable_risk", + "dismissed_comment": "This alert is accurate but we use a sanitizer." + } + } + } + } + } + }, + "responses": { + "200": { + "description": "Response", + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "number": { + "type": "integer", + "description": "The security alert number.", + "readOnly": true + }, + "state": { + "type": "string", + "description": "State of a Dependabot alert.", + "enum": [ + "dismissed", + "fixed", + "open" + ] + }, + "dependency": { + "type": "object", + "readOnly": true, + "properties": { + "package": { + "type": "object", + "description": "The details of the vulnerable package.", + "readOnly": true, + "properties": { + "ecosystem": { + "type": "string" + }, + "name": { + "type": "string" + } + } + }, + "manifest_path": { + "type": "string", + "description": "The path to the manifest filename.", + "readOnly": true + }, + "scope": { + "type": [ + "string", + "null" + ], + "description": "The scope of the vulnerable dependency.", + "readOnly": true, + "enum": [ + "development", + "runtime", + null + ] + } + } + }, + "security_advisory": { + "type": "object", + "description": "The details of the security advisory, including summary, description, and severity.", + "readOnly": true, + "properties": { + "ghsa_id": { + "type": "string" + }, + "cve_id": { + "type": [ + "string", + "null" + ] + }, + "summary": { + "type": "string" + }, + "description": { + "type": "string" + }, + "severity": { + "type": "string", + "enum": [ + "low", + "medium", + "high", + "critical" + ] + }, + "identifiers": { + "type": "array", + "items": { + "type": "object", + "properties": { + "type": { + "type": "string", + "enum": [ + "GHSA", + "CVE" + ] + }, + "value": { + "type": "string" + } + }, + "required": [ + "value", + "type" + ], + "additionalProperties": false + } + }, + "references": { + "type": "array", + "items": { + "type": "object", + "properties": { + "url": { + "type": "string", + "format": "uri" + } + }, + "required": [ + "url" + ], + "additionalProperties": false + } + }, + "cvss": { + "type": "object", + "properties": { + "score": { + "type": "number" + }, + "vector_string": { + "type": [ + "string", + "null" + ] + } + }, + "required": [ + "vector_string", + "score" + ], + "additionalProperties": false + }, + "cwes": { + "type": "array", + "items": { + "type": "object", + "properties": { + "cwe_id": { + "type": "string" + }, + "name": { + "type": "string" + } + }, + "required": [ + "cwe_id", + "name" + ], + "additionalProperties": false + } + }, + "published_at": { + "type": "string", + "format": "date-time" + }, + "updated_at": { + "type": "string", + "format": "date-time" + }, + "vulnerabilities": { + "type": "array", + "items": { + "type": "object", + "properties": { + "first_patched_version": { + "type": [ + "object", + "null" + ], + "properties": { + "identifier": { + "type": "string" + } + }, + "required": [ + "identifier" + ], + "additionalProperties": false + }, + "package": { + "type": "object", + "properties": { + "ecosystem": { + "type": "string" + }, + "name": { + "type": "string" + } + }, + "required": [ + "ecosystem", + "name" + ], + "additionalProperties": false + }, + "severity": { + "type": "string" + }, + "vulnerable_version_range": { + "type": "string" + } + }, + "required": [ + "package", + "severity", + "vulnerable_version_range", + "first_patched_version" + ], + "additionalProperties": false + } + }, + "withdrawn_at": { + "type": [ + "string", + "null" + ], + "format": "date-time" + } + }, + "required": [ + "cvss", + "cwes", + "ghsa_id", + "summary", + "description", + "severity", + "identifiers", + "references", + "published_at", + "updated_at", + "withdrawn_at", + "vulnerabilities" + ], + "additionalProperties": false + }, + "security_vulnerability": { + "type": "object", + "description": "The details of the vulnerability of a security advisory.", + "readOnly": true, + "properties": { + "package": { + "type": "object", + "description": "The details of the vulnerable package.", + "readOnly": true, + "properties": { + "ecosystem": { + "type": "string" + }, + "name": { + "type": "string" + } + } + }, + "severity": { + "type": "string" + }, + "vulnerable_version_range": { + "type": "string" + }, + "first_patched_version": { + "type": "object", + "properties": { + "identifier": { + "type": "string" + } + } + } + } + }, + "created_at": { + "type": "string", + "description": "The time that the alert was created in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.", + "format": "date-time", + "readOnly": true + }, + "updated_at": { + "type": "string", + "description": "The time that the alert was last updated in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.", + "format": "date-time", + "readOnly": true + }, + "url": { + "type": "string", + "description": "The REST API URL of the alert resource.", + "format": "uri", + "readOnly": true + }, + "html_url": { + "type": "string", + "description": "The GitHub URL of the alert resource.", + "format": "uri", + "readOnly": true + }, + "dismissed_at": { + "type": [ + "string", + "null" + ], + "description": "The time that the alert was dismissed in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.", + "format": "date-time", + "readOnly": true + }, + "dismissed_by": { + "anyOf": [ + { + "type": "null" + }, + { + "title": "Simple User", + "description": "Simple User", + "type": "object", + "properties": { + "name": { + "type": [ + "string", + "null" + ] + }, + "email": { + "type": [ + "string", + "null" + ] + }, + "login": { + "type": "string", + "examples": [ + "octocat" + ] + }, + "id": { + "type": "integer", + "examples": [ + 1 + ] + }, + "node_id": { + "type": "string", + "examples": [ + "MDQ6VXNlcjE=" + ] + }, + "avatar_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://github.com/images/error/octocat_happy.gif" + ] + }, + "gravatar_id": { + "type": [ + "string", + "null" + ], + "examples": [ + "41d064eb2195891e12d0413f63227ea7" + ] + }, + "url": { + "type": "string", + "format": "uri", + "examples": [ + "https://api.github.com/users/octocat" + ] + }, + "html_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://github.com/octocat" + ] + }, + "followers_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://api.github.com/users/octocat/followers" + ] + }, + "following_url": { + "type": "string", + "examples": [ + "https://api.github.com/users/octocat/following{/other_user}" + ] + }, + "gists_url": { + "type": "string", + "examples": [ + "https://api.github.com/users/octocat/gists{/gist_id}" + ] + }, + "starred_url": { + "type": "string", + "examples": [ + "https://api.github.com/users/octocat/starred{/owner}{/repo}" + ] + }, + "subscriptions_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://api.github.com/users/octocat/subscriptions" + ] + }, + "organizations_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://api.github.com/users/octocat/orgs" + ] + }, + "repos_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://api.github.com/users/octocat/repos" + ] + }, + "events_url": { + "type": "string", + "examples": [ + "https://api.github.com/users/octocat/events{/privacy}" + ] + }, + "received_events_url": { + "type": "string", + "format": "uri", + "examples": [ + "https://api.github.com/users/octocat/received_events" + ] + }, + "type": { + "type": "string", + "examples": [ + "User" + ] + }, + "site_admin": { + "type": "boolean" + }, + "starred_at": { + "type": "string", + "examples": [ + "\"2020-07-09T00:17:55Z\"" + ] + } + }, + "required": [ + "avatar_url", + "events_url", + "followers_url", + "following_url", + "gists_url", + "gravatar_id", + "html_url", + "id", + "node_id", + "login", + "organizations_url", + "received_events_url", + "repos_url", + "site_admin", + "starred_url", + "subscriptions_url", + "type", + "url" + ] + } + ] + }, + "dismissed_reason": { + "type": [ + "string", + "null" + ], + "description": "**Required when the `state` is `dismissed`.** The reason for dismissing the Dependabot alert.", + "enum": [ + "fix_started", + "inaccurate", + "no_bandwidth", + "not_used", + "tolerable_risk", + null + ] + }, + "dismissed_comment": { + "type": [ + "string", + "null" + ], + "description": "An optional comment associated with the alert's dismissal. The maximum size is 280 characters.", + "maxLength": 280 + }, + "fixed_at": { + "type": [ + "string", + "null" + ], + "description": "The time that the alert was no longer detected and was considered fixed in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.", + "format": "date-time", + "readOnly": true + } + }, + "required": [ + "number", + "state", + "dependency", + "security_advisory", + "security_vulnerability", + "url", + "html_url", + "dismissed_at", + "dismissed_by", + "dismissed_reason", + "dismissed_comment", + "fixed_at", + "created_at", + "updated_at" + ] + }, + "examples": { + "default": { + "value": { + "number": 2, + "state": "dismissed", + "dependency": { + "package": { + "ecosystem": "pip", + "name": "django" + }, + "manifest_path": "path/to/requirements.txt", + "scope": "runtime" + }, + "security_advisory": { + "ghsa_id": "GHSA-rf4j-j272-fj86", + "cve_id": "CVE-2018-6188", + "summary": "Django allows remote attackers to obtain potentially sensitive information by leveraging data exposure from the confirm_login_allowed() method, as demonstrated by discovering whether a user account is inactive", + "description": "django.contrib.auth.forms.AuthenticationForm in Django 2.0 before 2.0.2, and 1.11.8 and 1.11.9, allows remote attackers to obtain potentially sensitive information by leveraging data exposure from the confirm_login_allowed() method, as demonstrated by discovering whether a user account is inactive.", + "severity": "high", + "identifiers": [ + { + "type": "GHSA", + "value": "GHSA-rf4j-j272-fj86" + }, + { + "type": "CVE", + "value": "CVE-2018-6188" + } + ], + "references": [ + { + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-6188" + }, + { + "url": "https://github.com/advisories/GHSA-rf4j-j272-fj86" + }, + { + "url": "https://usn.ubuntu.com/3559-1/" + }, + { + "url": "https://www.djangoproject.com/weblog/2018/feb/01/security-releases/" + }, + { + "url": "http://www.securitytracker.com/id/1040422" + } + ], + "published_at": "2018-10-03T21:13:54Z", + "updated_at": "2022-04-26T18:35:37Z", + "withdrawn_at": null, + "vulnerabilities": [ + { + "package": { + "ecosystem": "pip", + "name": "django" + }, + "severity": "high", + "vulnerable_version_range": ">= 2.0.0, < 2.0.2", + "first_patched_version": { + "identifier": "2.0.2" + } + }, + { + "package": { + "ecosystem": "pip", + "name": "django" + }, + "severity": "high", + "vulnerable_version_range": ">= 1.11.8, < 1.11.10", + "first_patched_version": { + "identifier": "1.11.10" + } + } + ], + "cvss": { + "vector_string": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", + "score": 7.5 + }, + "cwes": [ + { + "cwe_id": "CWE-200", + "name": "Exposure of Sensitive Information to an Unauthorized Actor" + } + ] + }, + "security_vulnerability": { + "package": { + "ecosystem": "pip", + "name": "django" + }, + "severity": "high", + "vulnerable_version_range": ">= 2.0.0, < 2.0.2", + "first_patched_version": { + "identifier": "2.0.2" + } + }, + "url": "https://api.github.com/repos/octocat/hello-world/dependabot/alerts/2", + "html_url": "https://github.com/octocat/hello-world/security/dependabot/2", + "created_at": "2022-06-15T07:43:03Z", + "updated_at": "2022-08-23T14:29:47Z", + "dismissed_at": "2022-08-23T14:29:47Z", + "dismissed_by": { + "login": "octocat", + "id": 1, + "node_id": "MDQ6VXNlcjE=", + "avatar_url": "https://github.com/images/error/octocat_happy.gif", + "gravatar_id": "", + "url": "https://api.github.com/users/octocat", + "html_url": "https://github.com/octocat", + "followers_url": "https://api.github.com/users/octocat/followers", + "following_url": "https://api.github.com/users/octocat/following{/other_user}", + "gists_url": "https://api.github.com/users/octocat/gists{/gist_id}", + "starred_url": "https://api.github.com/users/octocat/starred{/owner}{/repo}", + "subscriptions_url": "https://api.github.com/users/octocat/subscriptions", + "organizations_url": "https://api.github.com/users/octocat/orgs", + "repos_url": "https://api.github.com/users/octocat/repos", + "events_url": "https://api.github.com/users/octocat/events{/privacy}", + "received_events_url": "https://api.github.com/users/octocat/received_events", + "type": "User", + "site_admin": false + }, + "dismissed_reason": "tolerable_risk", + "dismissed_comment": "This alert is accurate but we use a sanitizer.", + "fixed_at": null + } + } + } + } + } + }, + "304": { + "description": "Not modified" + }, + "400": { + "description": "Bad Request", + "content": { + "application/json": { + "schema": { + "title": "Basic Error", + "description": "Basic Error", + "type": "object", + "properties": { + "message": { + "type": "string" + }, + "documentation_url": { + "type": "string" + }, + "url": { + "type": "string" + }, + "status": { + "type": "string" + } + } + } + }, + "application/scim+json": { + "schema": { + "title": "Scim Error", + "description": "Scim Error", + "type": "object", + "properties": { + "message": { + "type": [ + "string", + "null" + ] + }, + "documentation_url": { + "type": [ + "string", + "null" + ] + }, + "detail": { + "type": [ + "string", + "null" + ] + }, + "status": { + "type": "integer" + }, + "scimType": { + "type": [ + "string", + "null" + ] + }, + "schemas": { + "type": "array", + "items": { + "type": "string" + } + } + } + } + } + } + }, + "403": { + "description": "Forbidden", + "content": { + "application/json": { + "schema": { + "title": "Basic Error", + "description": "Basic Error", + "type": "object", + "properties": { + "message": { + "type": "string" + }, + "documentation_url": { + "type": "string" + }, + "url": { + "type": "string" + }, + "status": { + "type": "string" + } + } + } + } + } + }, + "404": { + "description": "Resource not found", + "content": { + "application/json": { + "schema": { + "title": "Basic Error", + "description": "Basic Error", + "type": "object", + "properties": { + "message": { + "type": "string" + }, + "documentation_url": { + "type": "string" + }, + "url": { + "type": "string" + }, + "status": { + "type": "string" + } + } + } + } + } + }, + "409": { + "description": "Conflict", + "content": { + "application/json": { + "schema": { + "title": "Basic Error", + "description": "Basic Error", + "type": "object", + "properties": { + "message": { + "type": "string" + }, + "documentation_url": { + "type": "string" + }, + "url": { + "type": "string" + }, + "status": { + "type": "string" + } + } + } + } + } + }, + "422": { + "description": "Validation failed", + "content": { + "application/json": { + "schema": { + "title": "Validation Error Simple", + "description": "Validation Error Simple", + "type": "object", + "required": [ + "message", + "documentation_url" + ], + "properties": { + "message": { + "type": "string" + }, + "documentation_url": { + "type": "string" + }, + "errors": { + "type": "array", + "items": { + "type": "string" + } + } + } + } + } + } + } + }, + "x-github": { + "githubCloudOnly": false, + "enabledForGitHubApps": true, + "previews": [ + + ], + "category": "dependabot", + "subcategory": "alerts" + } + } + }, "/repos/{owner}/{repo}/dependabot/secrets": { "get": { "summary": "List repository secrets",