ran script/content-migrations/use-short-versions.js
This commit is contained in:
@@ -6,8 +6,8 @@ redirect_from:
|
||||
- /categories/managing-security-vulnerabilities
|
||||
- /github/managing-security-vulnerabilities
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=3.0'
|
||||
fpt: '*'
|
||||
ghes: '>=3.0'
|
||||
topics:
|
||||
- Dependabot
|
||||
- Dependencies
|
||||
|
||||
@@ -8,7 +8,7 @@ redirect_from:
|
||||
- /github/administering-a-repository/about-dependabot-version-updates
|
||||
- /code-security/supply-chain-security/about-dependabot-version-updates
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
fpt: '*'
|
||||
type: overview
|
||||
topics:
|
||||
- Dependabot
|
||||
|
||||
@@ -7,7 +7,7 @@ redirect_from:
|
||||
- /code-security/supply-chain-security/configuration-options-for-dependency-updates
|
||||
miniTocMaxHeadingLevel: 3
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
fpt: '*'
|
||||
type: reference
|
||||
topics:
|
||||
- Dependabot
|
||||
|
||||
@@ -6,7 +6,7 @@ redirect_from:
|
||||
- /github/administering-a-repository/customizing-dependency-updates
|
||||
- /code-security/supply-chain-security/customizing-dependency-updates
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
fpt: '*'
|
||||
type: how_to
|
||||
topics:
|
||||
- Dependabot
|
||||
|
||||
@@ -6,7 +6,7 @@ redirect_from:
|
||||
- /github/administering-a-repository/enabling-and-disabling-version-updates
|
||||
- /code-security/supply-chain-security/enabling-and-disabling-version-updates
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
fpt: '*'
|
||||
type: how_to
|
||||
topics:
|
||||
- Dependabot
|
||||
|
||||
@@ -4,7 +4,7 @@ intro: '{% data variables.product.prodname_dependabot %} can maintain your repos
|
||||
redirect_from:
|
||||
- /github/administering-a-repository/keeping-your-dependencies-updated-automatically
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
fpt: '*'
|
||||
topics:
|
||||
- Repositories
|
||||
- Dependabot
|
||||
|
||||
@@ -6,7 +6,7 @@ redirect_from:
|
||||
- /github/administering-a-repository/keeping-your-actions-up-to-date-with-dependabot
|
||||
- /code-security/supply-chain-security/keeping-your-actions-up-to-date-with-dependabot
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
fpt: '*'
|
||||
type: how_to
|
||||
topics:
|
||||
- Repositories
|
||||
|
||||
@@ -5,7 +5,7 @@ redirect_from:
|
||||
- /github/administering-a-repository/listing-dependencies-configured-for-version-updates
|
||||
- /code-security/supply-chain-security/listing-dependencies-configured-for-version-updates
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
fpt: '*'
|
||||
type: how_to
|
||||
topics:
|
||||
- Repositories
|
||||
|
||||
@@ -5,7 +5,7 @@ redirect_from:
|
||||
- /github/administering-a-repository/managing-encrypted-secrets-for-dependabot
|
||||
- /code-security/supply-chain-security/managing-encrypted-secrets-for-dependabot
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
fpt: '*'
|
||||
type: how_to
|
||||
topics:
|
||||
- Dependabot
|
||||
|
||||
@@ -5,7 +5,7 @@ redirect_from:
|
||||
- /github/administering-a-repository/managing-pull-requests-for-dependency-updates
|
||||
- /code-security/supply-chain-security/managing-pull-requests-for-dependency-updates
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
fpt: '*'
|
||||
type: how_to
|
||||
topics:
|
||||
- Repositories
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
title: Upgrading from Dependabot.com to GitHub-native Dependabot
|
||||
intro: You can upgrade to GitHub-native Dependabot by merging a pull request that will allow your dependencies to continue being updated.
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
fpt: '*'
|
||||
type: how_to
|
||||
topics:
|
||||
- Repositories
|
||||
|
||||
@@ -7,8 +7,8 @@ redirect_from:
|
||||
- /github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies
|
||||
- /code-security/supply-chain-security/about-alerts-for-vulnerable-dependencies
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=3.0'
|
||||
fpt: '*'
|
||||
ghes: '>=3.0'
|
||||
type: overview
|
||||
topics:
|
||||
- Dependabot
|
||||
@@ -30,10 +30,10 @@ When your code depends on a package that has a security vulnerability, this vuln
|
||||
|
||||
{% data variables.product.prodname_dependabot %} detects vulnerable dependencies and sends {% data variables.product.prodname_dependabot_alerts %} when:
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" %}
|
||||
{% ifversion fpt %}
|
||||
- A new vulnerability is added to the {% data variables.product.prodname_advisory_database %}. For more information, see "[Browsing security vulnerabilities in the {% data variables.product.prodname_advisory_database %}](/github/managing-security-vulnerabilities/browsing-security-vulnerabilities-in-the-github-advisory-database)" and "[About {% data variables.product.prodname_security_advisories %}](/code-security/security-advisories/about-github-security-advisories)."{% else %}
|
||||
- New advisory data is synchronized to {% data variables.product.prodname_ghe_server %} each hour from {% data variables.product.prodname_dotcom_the_website %}. {% data reusables.security-advisory.link-browsing-advisory-db %}{% endif %}
|
||||
- The dependency graph for a repository changes. For example, when a contributor pushes a commit to change the packages or versions it depends on{% if currentVersion == "free-pro-team@latest" %}, or when the code of one of the dependencies changes{% endif %}. For more information, see "[About the dependency graph](/code-security/supply-chain-security/about-the-dependency-graph)."
|
||||
- The dependency graph for a repository changes. For example, when a contributor pushes a commit to change the packages or versions it depends on{% ifversion fpt %}, or when the code of one of the dependencies changes{% endif %}. For more information, see "[About the dependency graph](/code-security/supply-chain-security/about-the-dependency-graph)."
|
||||
|
||||
{% data reusables.repositories.dependency-review %}
|
||||
|
||||
@@ -49,7 +49,7 @@ For a list of the ecosystems that {% data variables.product.product_name %} can
|
||||
|
||||
{% data reusables.repositories.enable-security-alerts %}
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" %}{% data variables.product.prodname_dotcom %} detects vulnerable dependencies in _public_ repositories and generates {% data variables.product.prodname_dependabot_alerts %} by default. Owners of private repositories, or people with admin access, can enable {% data variables.product.prodname_dependabot_alerts %} by enabling the dependency graph and {% data variables.product.prodname_dependabot_alerts %} for their repositories.
|
||||
{% ifversion fpt %}{% data variables.product.prodname_dotcom %} detects vulnerable dependencies in _public_ repositories and generates {% data variables.product.prodname_dependabot_alerts %} by default. Owners of private repositories, or people with admin access, can enable {% data variables.product.prodname_dependabot_alerts %} by enabling the dependency graph and {% data variables.product.prodname_dependabot_alerts %} for their repositories.
|
||||
|
||||
You can also enable or disable {% data variables.product.prodname_dependabot_alerts %} for all repositories owned by your user account or organization. For more information, see "[Managing security and analysis settings for your user account](/github/setting-up-and-managing-your-github-user-account/managing-security-and-analysis-settings-for-your-user-account)" or "[Managing security and analysis settings for your organization](/organizations/keeping-your-organization-secure/managing-security-and-analysis-settings-for-your-organization)."
|
||||
|
||||
@@ -60,7 +60,7 @@ For information about permission requirements for actions related to {% data var
|
||||
|
||||
When {% data variables.product.product_name %} identifies a vulnerable dependency, we generate a {% data variables.product.prodname_dependabot %} alert and display it on the Security tab for the repository. The alert includes a link to the affected file in the project, and information about a fixed version. {% data variables.product.product_name %} also notifies the maintainers of affected repositories about the new alert according to their notification preferences. For more information, see "[Configuring notifications for vulnerable dependencies](/code-security/supply-chain-security/configuring-notifications-for-vulnerable-dependencies)."
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" %}
|
||||
{% ifversion fpt %}
|
||||
For repositories where {% data variables.product.prodname_dependabot_security_updates %} are enabled, the alert may also contain a link to a pull request to update the manifest or lock file to the minimum version that resolves the vulnerability. For more information, see "[About {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/about-dependabot-security-updates)."
|
||||
{% endif %}
|
||||
|
||||
@@ -72,16 +72,16 @@ For repositories where {% data variables.product.prodname_dependabot_security_up
|
||||
|
||||
## Access to {% data variables.product.prodname_dependabot %} alerts
|
||||
|
||||
You can see all of the alerts that affect a particular project{% if currentVersion == "free-pro-team@latest" %} on the repository's Security tab or{% endif %} in the repository's dependency graph. For more information, see "[Viewing and updating vulnerable dependencies in your repository](/github/managing-security-vulnerabilities/viewing-and-updating-vulnerable-dependencies-in-your-repository)."
|
||||
You can see all of the alerts that affect a particular project{% ifversion fpt %} on the repository's Security tab or{% endif %} in the repository's dependency graph. For more information, see "[Viewing and updating vulnerable dependencies in your repository](/github/managing-security-vulnerabilities/viewing-and-updating-vulnerable-dependencies-in-your-repository)."
|
||||
|
||||
By default, we notify people with admin permissions in the affected repositories about new {% data variables.product.prodname_dependabot_alerts %}. {% if currentVersion == "free-pro-team@latest" %}{% data variables.product.product_name %} never publicly discloses identified vulnerabilities for any repository. You can also make {% data variables.product.prodname_dependabot_alerts %} visible to additional people or teams working repositories that you own or have admin permissions for. For more information, see "[Managing security and analysis settings for your repository](/github/administering-a-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts)."
|
||||
By default, we notify people with admin permissions in the affected repositories about new {% data variables.product.prodname_dependabot_alerts %}. {% ifversion fpt %}{% data variables.product.product_name %} never publicly discloses identified vulnerabilities for any repository. You can also make {% data variables.product.prodname_dependabot_alerts %} visible to additional people or teams working repositories that you own or have admin permissions for. For more information, see "[Managing security and analysis settings for your repository](/github/administering-a-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts)."
|
||||
{% endif %}
|
||||
|
||||
{% data reusables.notifications.vulnerable-dependency-notification-delivery-method-customization %} For more information, see "[Configuring notifications for vulnerable dependencies](/code-security/supply-chain-security/configuring-notifications-for-vulnerable-dependencies)."
|
||||
|
||||
You can also see all the {% data variables.product.prodname_dependabot_alerts %} that correspond to a particular vulnerability in the {% data variables.product.prodname_advisory_database %}. {% data reusables.security-advisory.link-browsing-advisory-db %}
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" %}
|
||||
{% ifversion fpt %}
|
||||
## Further reading
|
||||
|
||||
- "[About {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/about-dependabot-security-updates)"
|
||||
|
||||
@@ -7,7 +7,7 @@ redirect_from:
|
||||
- /github/managing-security-vulnerabilities/about-dependabot-security-updates
|
||||
- /code-security/supply-chain-security/about-dependabot-security-updates
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
fpt: '*'
|
||||
type: overview
|
||||
topics:
|
||||
- Dependabot
|
||||
|
||||
@@ -5,7 +5,7 @@ redirect_from:
|
||||
- /github/managing-security-vulnerabilities/about-managing-vulnerable-dependencies
|
||||
- /code-security/supply-chain-security/about-managing-vulnerable-dependencies
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
fpt: '*'
|
||||
type: overview
|
||||
topics:
|
||||
- Dependabot
|
||||
|
||||
@@ -6,7 +6,7 @@ redirect_from:
|
||||
- /github/managing-security-vulnerabilities/browsing-security-vulnerabilities-in-the-github-advisory-database
|
||||
- /code-security/supply-chain-security/browsing-security-vulnerabilities-in-the-github-advisory-database
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
fpt: '*'
|
||||
type: how_to
|
||||
topics:
|
||||
- Security advisories
|
||||
|
||||
@@ -10,7 +10,7 @@ redirect_from:
|
||||
- /github/managing-security-vulnerabilities/configuring-dependabot-security-updates
|
||||
- /code-security/supply-chain-security/configuring-dependabot-security-updates
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
fpt: '*'
|
||||
type: how_to
|
||||
topics:
|
||||
- Dependabot
|
||||
|
||||
@@ -6,8 +6,8 @@ redirect_from:
|
||||
- /github/managing-security-vulnerabilities/configuring-notifications-for-vulnerable-dependencies
|
||||
- /code-security/supply-chain-security/configuring-notifications-for-vulnerable-dependencies
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=3.0'
|
||||
fpt: '*'
|
||||
ghes: '>=3.0'
|
||||
type: how_to
|
||||
topics:
|
||||
- Dependabot
|
||||
@@ -21,16 +21,16 @@ topics:
|
||||
|
||||
## About notifications for vulnerable dependencies
|
||||
|
||||
When {% data variables.product.prodname_dependabot %} detects vulnerable dependencies in your repositories, we generate a {% data variables.product.prodname_dependabot %} alert and display it on the Security tab for the repository. {% data variables.product.product_name %} notifies the maintainers of affected repositories about the new alert according to their notification preferences.{% if currentVersion == "free-pro-team@latest" %} {% data variables.product.prodname_dependabot %} is enabled by default on all public repositories. For {% data variables.product.prodname_dependabot_alerts %}, by default, you will receive {% data variables.product.prodname_dependabot_alerts %} by email, grouped by the specific vulnerability.
|
||||
When {% data variables.product.prodname_dependabot %} detects vulnerable dependencies in your repositories, we generate a {% data variables.product.prodname_dependabot %} alert and display it on the Security tab for the repository. {% data variables.product.product_name %} notifies the maintainers of affected repositories about the new alert according to their notification preferences.{% ifversion fpt %} {% data variables.product.prodname_dependabot %} is enabled by default on all public repositories. For {% data variables.product.prodname_dependabot_alerts %}, by default, you will receive {% data variables.product.prodname_dependabot_alerts %} by email, grouped by the specific vulnerability.
|
||||
{% endif %}
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" %}If you're an organization owner, you can enable or disable {% data variables.product.prodname_dependabot_alerts %} for all repositories in your organization with one click. You can also set whether the detection of vulnerable dependencies will be enabled or disabled for newly-created repositories. For more information, see "[Managing security and analysis settings for your organization](/organizations/keeping-your-organization-secure/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-new-repositories-when-they-are-added)."
|
||||
{% ifversion fpt %}If you're an organization owner, you can enable or disable {% data variables.product.prodname_dependabot_alerts %} for all repositories in your organization with one click. You can also set whether the detection of vulnerable dependencies will be enabled or disabled for newly-created repositories. For more information, see "[Managing security and analysis settings for your organization](/organizations/keeping-your-organization-secure/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-new-repositories-when-they-are-added)."
|
||||
{% endif %}
|
||||
|
||||
{% if enterpriseServerVersions contains currentVersion and currentVersion ver_gt "enterprise-server@2.20" %}
|
||||
{% ifversion ghes %}
|
||||
By default, if your site administrator has configured email for notifications on your enterprise, you will receive {% data variables.product.prodname_dependabot_alerts %} by email.{% endif %}
|
||||
|
||||
{% if currentVersion ver_gt "enterprise-server@2.21" %}Site administrators can also enable {% data variables.product.prodname_dependabot_alerts %} without notifications. For more information, see "[Enabling {% data variables.product.prodname_dependabot_alerts %} for vulnerable dependencies on {% data variables.product.prodname_ghe_server %}](/enterprise/{{ currentVersion }}/admin/configuration/enabling-alerts-for-vulnerable-dependencies-on-github-enterprise-server)."{% endif %}
|
||||
{% ifversion ghes > 2.21 %}Site administrators can also enable {% data variables.product.prodname_dependabot_alerts %} without notifications. For more information, see "[Enabling {% data variables.product.prodname_dependabot_alerts %} for vulnerable dependencies on {% data variables.product.prodname_ghe_server %}](/enterprise/{{ currentVersion }}/admin/configuration/enabling-alerts-for-vulnerable-dependencies-on-github-enterprise-server)."{% endif %}
|
||||
|
||||
## Configuring notifications for {% data variables.product.prodname_dependabot_alerts %}
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Managing vulnerabilities in your project's dependencies
|
||||
intro: 'You can track your repository''s dependencies and receive {% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.21" %}{% data variables.product.prodname_dependabot_alerts %}{% else %}security alerts{% endif %} when {% data variables.product.product_name %} detects vulnerable dependencies.'
|
||||
intro: 'You can track your repository''s dependencies and receive {% ifversion fpt or ghes > 2.21 %}{% data variables.product.prodname_dependabot_alerts %}{% else %}security alerts{% endif %} when {% data variables.product.product_name %} detects vulnerable dependencies.'
|
||||
redirect_from:
|
||||
- /articles/updating-your-project-s-dependencies/
|
||||
- /articles/updating-your-projects-dependencies/
|
||||
@@ -8,8 +8,8 @@ redirect_from:
|
||||
- /articles/managing-vulnerabilities-in-your-projects-dependencies
|
||||
- /github/managing-security-vulnerabilities/managing-vulnerabilities-in-your-projects-dependencies
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=3.0'
|
||||
fpt: '*'
|
||||
ghes: '>=3.0'
|
||||
topics:
|
||||
- Repositories
|
||||
- Dependabot
|
||||
|
||||
@@ -7,7 +7,7 @@ redirect_from:
|
||||
- /github/managing-security-vulnerabilities/troubleshooting-dependabot-errors
|
||||
- /code-security/supply-chain-security/troubleshooting-dependabot-errors
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
fpt: '*'
|
||||
type: how_to
|
||||
topics:
|
||||
- Dependabot
|
||||
|
||||
@@ -6,8 +6,8 @@ redirect_from:
|
||||
- /github/managing-security-vulnerabilities/troubleshooting-the-detection-of-vulnerable-dependencies
|
||||
- /code-security/supply-chain-security/troubleshooting-the-detection-of-vulnerable-dependencies
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=3.0'
|
||||
fpt: '*'
|
||||
ghes: '>=3.0'
|
||||
type: how_to
|
||||
topics:
|
||||
- Dependabot
|
||||
@@ -31,15 +31,15 @@ The results of dependency detection reported by {% data variables.product.produc
|
||||
* {% data variables.product.prodname_advisory_database %} is one of the data sources that {% data variables.product.prodname_dotcom %} uses to identify vulnerable dependencies. It's a free, curated database of vulnerability information for common package ecosystems on {% data variables.product.prodname_dotcom %}. It includes both data reported directly to {% data variables.product.prodname_dotcom %} from {% data variables.product.prodname_security_advisories %}, as well as official feeds and community sources. This data is reviewed and curated by {% data variables.product.prodname_dotcom %} to ensure that false or unactionable information is not shared with the development community. {% data reusables.security-advisory.link-browsing-advisory-db %}
|
||||
* The dependency graph parses all known package manifest files in a user’s repository. For example, for npm it will parse the _package-lock.json_ file. It constructs a graph of all of the repository’s dependencies and public dependents. This happens when you enable the dependency graph and when anyone pushes to the default branch, and it includes commits that makes changes to a supported manifest format. For more information, see "[About the dependency graph](/github/visualizing-repository-data-with-graphs/about-the-dependency-graph)."
|
||||
* {% data variables.product.prodname_dependabot %} scans any push, to the default branch, that contains a manifest file. When a new vulnerability record is added, it scans all existing repositories and generates an alert for each vulnerable repository. {% data variables.product.prodname_dependabot_alerts %} are aggregated at the repository level, rather than creating one alert per vulnerability. For more information, see "[About alerts for vulnerable dependencies](/code-security/supply-chain-security/about-alerts-for-vulnerable-dependencies)."
|
||||
* {% if currentVersion == "free-pro-team@latest" %}{% data variables.product.prodname_dependabot_security_updates %} are triggered when you receive an alert about a vulnerable dependency in your repository. Where possible, {% data variables.product.prodname_dependabot %} creates a pull request in your repository to upgrade the vulnerable dependency to the minimum possible secure version needed to avoid the vulnerability. For more information, see "[About {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/about-dependabot-security-updates)" and "[Troubleshooting {% data variables.product.prodname_dependabot %} errors](/github/managing-security-vulnerabilities/troubleshooting-dependabot-errors)."
|
||||
* {% ifversion fpt %}{% data variables.product.prodname_dependabot_security_updates %} are triggered when you receive an alert about a vulnerable dependency in your repository. Where possible, {% data variables.product.prodname_dependabot %} creates a pull request in your repository to upgrade the vulnerable dependency to the minimum possible secure version needed to avoid the vulnerability. For more information, see "[About {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/about-dependabot-security-updates)" and "[Troubleshooting {% data variables.product.prodname_dependabot %} errors](/github/managing-security-vulnerabilities/troubleshooting-dependabot-errors)."
|
||||
|
||||
{% endif %}{% data variables.product.prodname_dependabot %} doesn't scan repositories for vulnerable dependencies on a schedule, but rather when something changes. For example, a scan is triggered when a new dependency is added ({% data variables.product.prodname_dotcom %} checks for this on every push), or when a new vulnerability is added to the advisory database{% if currentVersion ver_gt "enterprise-server@2.22" %} and synchronized to {% data variables.product.prodname_ghe_server %}{% endif %}. For more information, see "[About alerts for vulnerable dependencies](/code-security/supply-chain-security/about-alerts-for-vulnerable-dependencies#detection-of-vulnerable-dependencies)."
|
||||
{% endif %}{% data variables.product.prodname_dependabot %} doesn't scan repositories for vulnerable dependencies on a schedule, but rather when something changes. For example, a scan is triggered when a new dependency is added ({% data variables.product.prodname_dotcom %} checks for this on every push), or when a new vulnerability is added to the advisory database{% ifversion ghes > 2.22 %} and synchronized to {% data variables.product.prodname_ghe_server %}{% endif %}. For more information, see "[About alerts for vulnerable dependencies](/code-security/supply-chain-security/about-alerts-for-vulnerable-dependencies#detection-of-vulnerable-dependencies)."
|
||||
|
||||
## Why don't I get vulnerability alerts for some ecosystems?
|
||||
|
||||
{% data variables.product.prodname_dotcom %} limits its support for vulnerability alerts to a set of ecosystems where we can provide high-quality, actionable data. Curated vulnerabilities in the {% data variables.product.prodname_advisory_database %}, the dependency graph, {% if currentVersion == "free-pro-team@latest" %}{% data variables.product.prodname_dependabot %} security updates, {% endif %}and {% data variables.product.prodname_dependabot %} alerts are provided for several ecosystems, including Java’s Maven, JavaScript’s npm and Yarn, .NET’s NuGet, Python’s pip, Ruby's RubyGems, and PHP’s Composer. We'll continue to add support for more ecosystems over time. For an overview of the package ecosystems that we support, see "[About the dependency graph](/github/visualizing-repository-data-with-graphs/about-the-dependency-graph#supported-package-ecosystems)."
|
||||
{% data variables.product.prodname_dotcom %} limits its support for vulnerability alerts to a set of ecosystems where we can provide high-quality, actionable data. Curated vulnerabilities in the {% data variables.product.prodname_advisory_database %}, the dependency graph, {% ifversion fpt %}{% data variables.product.prodname_dependabot %} security updates, {% endif %}and {% data variables.product.prodname_dependabot %} alerts are provided for several ecosystems, including Java’s Maven, JavaScript’s npm and Yarn, .NET’s NuGet, Python’s pip, Ruby's RubyGems, and PHP’s Composer. We'll continue to add support for more ecosystems over time. For an overview of the package ecosystems that we support, see "[About the dependency graph](/github/visualizing-repository-data-with-graphs/about-the-dependency-graph#supported-package-ecosystems)."
|
||||
|
||||
It's worth noting that {% data variables.product.prodname_dotcom %} Security Advisories may exist for other ecosystems. The information in a security advisory is provided by the maintainers of a particular repository. This data is not curated in the same way as information for the supported ecosystems. {% if currentVersion == "free-pro-team@latest" %}For more information, see "[About {% data variables.product.prodname_dotcom %} Security Advisories](/github/managing-security-vulnerabilities/about-github-security-advisories)."{% endif %}
|
||||
It's worth noting that {% data variables.product.prodname_dotcom %} Security Advisories may exist for other ecosystems. The information in a security advisory is provided by the maintainers of a particular repository. This data is not curated in the same way as information for the supported ecosystems. {% ifversion fpt %}For more information, see "[About {% data variables.product.prodname_dotcom %} Security Advisories](/github/managing-security-vulnerabilities/about-github-security-advisories)."{% endif %}
|
||||
|
||||
**Check**: Does the uncaught vulnerability apply to an unsupported ecosystem?
|
||||
|
||||
@@ -47,7 +47,7 @@ It's worth noting that {% data variables.product.prodname_dotcom %} Security Adv
|
||||
|
||||
The dependency graph includes information on dependencies that are explicitly declared in your environment. That is, dependencies that are specified in a manifest or a lockfile. The dependency graph generally also includes transitive dependencies, even when they aren't specified in a lockfile, by looking at the dependencies of the dependencies in a manifest file.
|
||||
|
||||
{% data variables.product.prodname_dependabot_alerts %} advise you about dependencies you should update, including transitive dependencies, where the version can be determined from a manifest or a lockfile. {% if currentVersion == "free-pro-team@latest" %}{% data variables.product.prodname_dependabot_security_updates %} only suggest a change where {% data variables.product.prodname_dependabot %} can directly "fix" the dependency, that is, when these are:
|
||||
{% data variables.product.prodname_dependabot_alerts %} advise you about dependencies you should update, including transitive dependencies, where the version can be determined from a manifest or a lockfile. {% ifversion fpt %}{% data variables.product.prodname_dependabot_security_updates %} only suggest a change where {% data variables.product.prodname_dependabot %} can directly "fix" the dependency, that is, when these are:
|
||||
* Direct dependencies explicitly declared in a manifest or lockfile
|
||||
* Transitive dependencies declared in a lockfile{% endif %}
|
||||
|
||||
@@ -95,7 +95,7 @@ Some third-party tools use uncurated CVE data that isn't checked or filtered by
|
||||
|
||||
Since {% data variables.product.prodname_dependabot %} uses curated data in the {% data variables.product.prodname_advisory_database %}, the volume of alerts may be lower, but the alerts you do receive will be accurate and relevant.
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" %}
|
||||
{% ifversion fpt %}
|
||||
## Does each dependency vulnerability generate a separate alert?
|
||||
|
||||
When a dependency has multiple vulnerabilities, only one aggregated alert is generated for that dependency, instead of one alert per vulnerability.
|
||||
@@ -115,5 +115,5 @@ When you click to display the alert details, you can see how many vulnerabilitie
|
||||
|
||||
- "[About alerts for vulnerable dependencies](/code-security/supply-chain-security/about-alerts-for-vulnerable-dependencies)"
|
||||
- "[Viewing and updating vulnerable dependencies in your repository](/github/managing-security-vulnerabilities/viewing-and-updating-vulnerable-dependencies-in-your-repository)"
|
||||
- "[Managing security and analysis settings for your repository](/github/administering-a-repository/managing-security-and-analysis-settings-for-your-repository)"{% if currentVersion == "free-pro-team@latest" %}
|
||||
- "[Managing security and analysis settings for your repository](/github/administering-a-repository/managing-security-and-analysis-settings-for-your-repository)"{% ifversion fpt %}
|
||||
- "[Troubleshooting {% data variables.product.prodname_dependabot %} errors](/github/managing-security-vulnerabilities/troubleshooting-dependabot-errors)"{% endif %}
|
||||
|
||||
@@ -8,8 +8,8 @@ redirect_from:
|
||||
permissions: Repository administrators and organization owners can view and update dependencies.
|
||||
shortTitle: Viewing and updating vulnerable dependencies
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=3.0'
|
||||
fpt: '*'
|
||||
ghes: '>=3.0'
|
||||
type: how_to
|
||||
topics:
|
||||
- Dependabot
|
||||
@@ -19,9 +19,9 @@ topics:
|
||||
- Pull requests
|
||||
- Repositories
|
||||
---
|
||||
Your repository's {% data variables.product.prodname_dependabot %} alerts tab lists all open and closed {% data variables.product.prodname_dependabot_alerts %}{% if currentVersion == "free-pro-team@latest" %} and corresponding {% data variables.product.prodname_dependabot_security_updates %}{% endif %}. You can sort the list of alerts using the drop-down menu, and you can click into specific alerts for more details. For more information, see "[About alerts for vulnerable dependencies](/code-security/supply-chain-security/about-alerts-for-vulnerable-dependencies)."
|
||||
Your repository's {% data variables.product.prodname_dependabot %} alerts tab lists all open and closed {% data variables.product.prodname_dependabot_alerts %}{% ifversion fpt %} and corresponding {% data variables.product.prodname_dependabot_security_updates %}{% endif %}. You can sort the list of alerts using the drop-down menu, and you can click into specific alerts for more details. For more information, see "[About alerts for vulnerable dependencies](/code-security/supply-chain-security/about-alerts-for-vulnerable-dependencies)."
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" %}
|
||||
{% ifversion fpt %}
|
||||
You can enable automatic security updates for any repository that uses {% data variables.product.prodname_dependabot_alerts %} and the dependency graph. For more information, see "[About {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/about-dependabot-security-updates)."
|
||||
|
||||
{% data reusables.repositories.dependency-review %}
|
||||
@@ -33,7 +33,7 @@ You can enable automatic security updates for any repository that uses {% data v
|
||||
|
||||
## Viewing and updating vulnerable dependencies
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" %}
|
||||
{% ifversion fpt %}
|
||||
{% data reusables.repositories.navigate-to-repo %}
|
||||
{% data reusables.repositories.sidebar-security %}
|
||||
{% data reusables.repositories.sidebar-dependabot-alerts %}
|
||||
@@ -46,7 +46,7 @@ You can enable automatic security updates for any repository that uses {% data v
|
||||
1. Optionally, if the alert is being fixed, if it's incorrect, or located in unused code, use the "Dismiss" drop-down, and click a reason for dismissing the alert.
|
||||

|
||||
|
||||
{% elsif currentVersion ver_gt "enterprise-server@3.0" %}
|
||||
{% elsif ghes > 3.0 %}
|
||||
{% data reusables.repositories.navigate-to-repo %}
|
||||
{% data reusables.repositories.sidebar-security %}
|
||||
{% data reusables.repositories.sidebar-dependabot-alerts %}
|
||||
@@ -69,8 +69,8 @@ You can enable automatic security updates for any repository that uses {% data v
|
||||
|
||||
## Further reading
|
||||
|
||||
- "[About alerts for vulnerable dependencies](/code-security/supply-chain-security/about-alerts-for-vulnerable-dependencies)"{% if currentVersion == "free-pro-team@latest" %}
|
||||
- "[About alerts for vulnerable dependencies](/code-security/supply-chain-security/about-alerts-for-vulnerable-dependencies)"{% ifversion fpt %}
|
||||
- "[Configuring {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/configuring-dependabot-security-updates)"{% endif %}
|
||||
- "[Managing security and analysis settings for your repository](/github/administering-a-repository/managing-security-and-analysis-settings-for-your-repository)"
|
||||
- "[Troubleshooting the detection of vulnerable dependencies](/github/managing-security-vulnerabilities/troubleshooting-the-detection-of-vulnerable-dependencies)"{% if currentVersion == "free-pro-team@latest" %}
|
||||
- "[Troubleshooting the detection of vulnerable dependencies](/github/managing-security-vulnerabilities/troubleshooting-the-detection-of-vulnerable-dependencies)"{% ifversion fpt %}
|
||||
- "[Troubleshooting {% data variables.product.prodname_dependabot %} errors](/github/managing-security-vulnerabilities/troubleshooting-dependabot-errors)"{% endif %}
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
title: About dependency review
|
||||
intro: 'Dependency review lets you catch vulnerable dependencies before you introduce them to your environment, and provides information on license, dependents, and age of dependencies.'
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
fpt: '*'
|
||||
type: overview
|
||||
topics:
|
||||
- Advanced Security
|
||||
|
||||
@@ -5,8 +5,8 @@ redirect_from:
|
||||
- /github/visualizing-repository-data-with-graphs/about-the-dependency-graph
|
||||
- /code-security/supply-chain-security/about-the-dependency-graph
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=3.0'
|
||||
fpt: '*'
|
||||
ghes: '>=3.0'
|
||||
type: overview
|
||||
topics:
|
||||
- Dependency graph
|
||||
@@ -18,20 +18,20 @@ topics:
|
||||
|
||||
## Dependency graph availability
|
||||
|
||||
The dependency graph is available for every{% if currentVersion == "free-pro-team@latest" %} public{% endif %} repository that defines dependencies in a supported package ecosystem using a supported file format.{% if currentVersion == "free-pro-team@latest" %} Repository administrators can also set up the dependency graph for private repositories.{% endif %}
|
||||
The dependency graph is available for every{% ifversion fpt %} public{% endif %} repository that defines dependencies in a supported package ecosystem using a supported file format.{% ifversion fpt %} Repository administrators can also set up the dependency graph for private repositories.{% endif %}
|
||||
|
||||
{% data reusables.repositories.enable-security-alerts %}
|
||||
|
||||
## About the dependency graph
|
||||
|
||||
The dependency graph is a summary of the manifest and lock files stored in a repository. For each repository, it shows{% if currentVersion == "free-pro-team@latest" %}:
|
||||
The dependency graph is a summary of the manifest and lock files stored in a repository. For each repository, it shows{% ifversion fpt %}:
|
||||
|
||||
- Dependencies, the ecosystems and packages it depends on
|
||||
- Dependents, the repositories and packages that depend on it{% else %} dependencies, that is, the ecosystems and packages it depends on. {% data variables.product.prodname_ghe_server %} does not calculate information about dependents, the repositories and packages that depend on a repository.{% endif %}
|
||||
|
||||
When you push a commit to {% data variables.product.product_name %} that changes or adds a supported manifest or lock file to the default branch, the dependency graph is automatically updated.{% if currentVersion == "free-pro-team@latest" %} In addition, the graph is updated when anyone pushes a change to the repository of one of your dependencies.{% endif %} For information on the supported ecosystems and manifest files, see "[Supported package ecosystems](#supported-package-ecosystems)" below.
|
||||
When you push a commit to {% data variables.product.product_name %} that changes or adds a supported manifest or lock file to the default branch, the dependency graph is automatically updated.{% ifversion fpt %} In addition, the graph is updated when anyone pushes a change to the repository of one of your dependencies.{% endif %} For information on the supported ecosystems and manifest files, see "[Supported package ecosystems](#supported-package-ecosystems)" below.
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" %}
|
||||
{% ifversion fpt %}
|
||||
When you create a pull request containing changes to dependencies that targets the default branch, {% data variables.product.prodname_dotcom %} uses the dependency graph to add dependency reviews to the pull request. These indicate whether the dependencies contain vulnerabilities and, if so, the version of the dependency in which the vulnerability was fixed. For more information, see "[About dependency review](/code-security/supply-chain-security/about-dependency-review)."
|
||||
{% endif %}
|
||||
|
||||
@@ -42,9 +42,9 @@ The dependency graph includes all the dependencies of a repository that are deta
|
||||
- Direct dependencies, that are explicitly defined in a manifest or lock file
|
||||
- Indirect dependencies of these direct dependencies, also known as transitive dependencies or sub-dependencies
|
||||
|
||||
The dependency graph identifies indirect dependencies{% if currentVersion == "free-pro-team@latest" %} either explicitly from a lock file or by checking the dependencies of your direct dependencies. For the most reliable graph, you should use lock files (or their equivalent) because they define exactly which versions of the direct and indirect dependencies you currently use. If you use lock files, you also ensure that all contributors to the repository are using the same versions, which will make it easier for you to test and debug code{% else %} from the lock files{% endif %}.
|
||||
The dependency graph identifies indirect dependencies{% ifversion fpt %} either explicitly from a lock file or by checking the dependencies of your direct dependencies. For the most reliable graph, you should use lock files (or their equivalent) because they define exactly which versions of the direct and indirect dependencies you currently use. If you use lock files, you also ensure that all contributors to the repository are using the same versions, which will make it easier for you to test and debug code{% else %} from the lock files{% endif %}.
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" %}
|
||||
{% ifversion fpt %}
|
||||
## Dependents included
|
||||
|
||||
For public repositories, only public repositories that depend on it or on packages that it publishes are reported. This information is not reported for private repositories.{% endif %}
|
||||
@@ -53,22 +53,22 @@ For public repositories, only public repositories that depend on it or on packag
|
||||
|
||||
You can use the dependency graph to:
|
||||
|
||||
- Explore the repositories your code depends on{% if currentVersion == "free-pro-team@latest" %}, and those that depend on it{% endif %}. For more information, see "[Exploring the dependencies of a repository](/github/visualizing-repository-data-with-graphs/exploring-the-dependencies-of-a-repository)." {% if currentVersion == "free-pro-team@latest" %}
|
||||
- Explore the repositories your code depends on{% ifversion fpt %}, and those that depend on it{% endif %}. For more information, see "[Exploring the dependencies of a repository](/github/visualizing-repository-data-with-graphs/exploring-the-dependencies-of-a-repository)." {% ifversion fpt %}
|
||||
- View a summary of the dependencies used in your organization's repositories in a single dashboard. For more information, see "[Viewing insights for your organization](/articles/viewing-insights-for-your-organization#viewing-organization-dependency-insights)."{% endif %}
|
||||
- View and update vulnerable dependencies for your repository. For more information, see "[About alerts for vulnerable dependencies](/code-security/supply-chain-security/about-alerts-for-vulnerable-dependencies)."{% if currentVersion == "free-pro-team@latest" %}
|
||||
- View and update vulnerable dependencies for your repository. For more information, see "[About alerts for vulnerable dependencies](/code-security/supply-chain-security/about-alerts-for-vulnerable-dependencies)."{% ifversion fpt %}
|
||||
- See information about vulnerable dependencies in pull requests. For more information, see "[Reviewing dependency changes in a pull request](/github/collaborating-with-issues-and-pull-requests/reviewing-dependency-changes-in-a-pull-request)."{% endif %}
|
||||
|
||||
## Enabling the dependency graph
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" %}To generate a dependency graph, {% data variables.product.product_name %} needs read-only access to the dependency manifest and lock files for a repository. The dependency graph is automatically generated for all public repositories and you can choose to enable it for private repositories. For information about enabling or disabling it for private repositories, see "[Exploring the dependencies of a repository](/github/visualizing-repository-data-with-graphs/exploring-the-dependencies-of-a-repository)."{% endif %}
|
||||
{% ifversion fpt %}To generate a dependency graph, {% data variables.product.product_name %} needs read-only access to the dependency manifest and lock files for a repository. The dependency graph is automatically generated for all public repositories and you can choose to enable it for private repositories. For information about enabling or disabling it for private repositories, see "[Exploring the dependencies of a repository](/github/visualizing-repository-data-with-graphs/exploring-the-dependencies-of-a-repository)."{% endif %}
|
||||
|
||||
{% if enterpriseServerVersions contains currentVersion and currentVersion ver_gt "enterprise-server@2.21" %}If the dependency graph is not available in your system, your site administrator can enable the dependency graph and {% data variables.product.prodname_dependabot_alerts %}. For more information, see "[Enabling alerts for vulnerable dependencies on {% data variables.product.prodname_ghe_server %}](/enterprise/{{ currentVersion }}/admin/configuration/enabling-alerts-for-vulnerable-dependencies-on-github-enterprise-server)."{% endif %}
|
||||
{% ifversion ghes > 2.21 %}If the dependency graph is not available in your system, your site administrator can enable the dependency graph and {% data variables.product.prodname_dependabot_alerts %}. For more information, see "[Enabling alerts for vulnerable dependencies on {% data variables.product.prodname_ghe_server %}](/enterprise/{{ currentVersion }}/admin/configuration/enabling-alerts-for-vulnerable-dependencies-on-github-enterprise-server)."{% endif %}
|
||||
|
||||
When the dependency graph is first enabled, any manifest and lock files for supported ecosystems are parsed immediately. The graph is usually populated within minutes but this may take longer for repositories with many dependencies. Once enabled, the graph is automatically updated with every push to the repository{% if currentVersion == "free-pro-team@latest" %} and every push to other repositories in the graph{% endif %}.
|
||||
When the dependency graph is first enabled, any manifest and lock files for supported ecosystems are parsed immediately. The graph is usually populated within minutes but this may take longer for repositories with many dependencies. Once enabled, the graph is automatically updated with every push to the repository{% ifversion fpt %} and every push to other repositories in the graph{% endif %}.
|
||||
|
||||
## Supported package ecosystems
|
||||
|
||||
The recommended formats explicitly define which versions are used for all direct and all indirect dependencies. If you use these formats, your dependency graph is more accurate. It also reflects the current build set up and enables the dependency graph to report vulnerabilities in both direct and indirect dependencies.{% if currentVersion == "free-pro-team@latest" %} Indirect dependencies that are inferred from a manifest file (or equivalent) are excluded from the checks for vulnerable dependencies.{% endif %}
|
||||
The recommended formats explicitly define which versions are used for all direct and all indirect dependencies. If you use these formats, your dependency graph is more accurate. It also reflects the current build set up and enables the dependency graph to report vulnerabilities in both direct and indirect dependencies.{% ifversion fpt %} Indirect dependencies that are inferred from a manifest file (or equivalent) are excluded from the checks for vulnerable dependencies.{% endif %}
|
||||
|
||||
| Package manager | Languages | Recommended formats | All supported formats |
|
||||
| --- | --- | --- | ---|
|
||||
@@ -89,7 +89,7 @@ The recommended formats explicitly define which versions are used for all direct
|
||||
## Further reading
|
||||
|
||||
- "[Dependency graph](https://en.wikipedia.org/wiki/Dependency_graph)" on Wikipedia
|
||||
- "[Exploring the dependencies of a repository](/github/visualizing-repository-data-with-graphs/exploring-the-dependencies-of-a-repository)"{% if currentVersion == "free-pro-team@latest" %}
|
||||
- "[Exploring the dependencies of a repository](/github/visualizing-repository-data-with-graphs/exploring-the-dependencies-of-a-repository)"{% ifversion fpt %}
|
||||
- "[Viewing insights for your organization](/organizations/collaborating-with-groups-in-organizations/viewing-insights-for-your-organization)"{% endif %}
|
||||
- "[Viewing and updating vulnerable dependencies in your repository](/github/managing-security-vulnerabilities/viewing-and-updating-vulnerable-dependencies-in-your-repository)"
|
||||
- "[Troubleshooting the detection of vulnerable dependencies](/github/managing-security-vulnerabilities/troubleshooting-the-detection-of-vulnerable-dependencies)"
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Exploring the dependencies of a repository
|
||||
intro: 'You can use the dependency graph to see the packages your project depends on{% if currentVersion == "free-pro-team@latest" %} and the repositories that depend on it{% endif %}. In addition, you can see any vulnerabilities detected in its dependencies.'
|
||||
intro: 'You can use the dependency graph to see the packages your project depends on{% ifversion fpt %} and the repositories that depend on it{% endif %}. In addition, you can see any vulnerabilities detected in its dependencies.'
|
||||
redirect_from:
|
||||
- /articles/listing-the-packages-that-a-repository-depends-on
|
||||
- /github/visualizing-repository-data-with-graphs/listing-the-packages-that-a-repository-depends-on
|
||||
@@ -10,8 +10,8 @@ redirect_from:
|
||||
- /github/visualizing-repository-data-with-graphs/exploring-the-dependencies-of-a-repository
|
||||
- /code-security/supply-chain-security/exploring-the-dependencies-of-a-repository
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=3.0'
|
||||
fpt: '*'
|
||||
ghes: '>=3.0'
|
||||
type: how_to
|
||||
topics:
|
||||
- Dependency graph
|
||||
@@ -24,17 +24,17 @@ topics:
|
||||
|
||||
{% data reusables.repositories.enable-security-alerts %}
|
||||
|
||||
The dependency graph shows the dependencies{% if currentVersion == "free-pro-team@latest" %} and dependents{% endif %} of your repository. For information about the detection of dependencies and which ecosystems are supported, see "[About the dependency graph](/github/visualizing-repository-data-with-graphs/about-the-dependency-graph)."
|
||||
The dependency graph shows the dependencies{% ifversion fpt %} and dependents{% endif %} of your repository. For information about the detection of dependencies and which ecosystems are supported, see "[About the dependency graph](/github/visualizing-repository-data-with-graphs/about-the-dependency-graph)."
|
||||
|
||||
{% data reusables.repositories.navigate-to-repo %}
|
||||
{% data reusables.repositories.accessing-repository-graphs %}
|
||||
{% data reusables.repositories.click-dependency-graph %}{% if currentVersion == "free-pro-team@latest" %}
|
||||
{% data reusables.repositories.click-dependency-graph %}{% ifversion fpt %}
|
||||
4. Optionally, under "Dependency graph", click **Dependents**.
|
||||
{% endif %}
|
||||
|
||||
### Dependencies view
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" %}
|
||||
{% ifversion fpt %}
|
||||
Dependencies are grouped by ecosystem. You can expand a dependency to view its dependencies. For dependencies on public repositories hosted on {% data variables.product.product_name %}, you can also click a dependency to view the repository. Dependencies on private repositories, private packages, or unrecognized files are shown in plain text.
|
||||
|
||||
If vulnerabilities have been detected in the repository, these are shown at the top of the view for users with access to {% data variables.product.prodname_dependabot_alerts %}.
|
||||
@@ -43,7 +43,7 @@ If vulnerabilities have been detected in the repository, these are shown at the
|
||||
|
||||
{% endif %}
|
||||
|
||||
{% if enterpriseServerVersions contains currentVersion and currentVersion ver_gt "enterprise-server@2.21" %}
|
||||
{% ifversion ghes > 2.21 %}
|
||||
Any direct and indirect dependencies that are specified in the repository's manifest or lock files are listed, grouped by ecosystem. If vulnerabilities have been detected in the repository, these are shown at the top of the view for users with access to {% data variables.product.prodname_dependabot_alerts %}.
|
||||
|
||||

|
||||
@@ -56,7 +56,7 @@ Any direct and indirect dependencies that are specified in the repository's mani
|
||||
|
||||
{% endif %}
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" %}
|
||||
{% ifversion fpt %}
|
||||
### Dependents view
|
||||
|
||||
For public repositories, the dependents view shows how the repository is used by other repositories. To show only the repositories that contain a library in a package manager, click **NUMBER Packages** immediately above the list of dependent repositories. The dependent counts are approximate and may not always match the dependents listed.
|
||||
@@ -101,7 +101,7 @@ The "Used by" section represents a single package from the repository. If you ha
|
||||
|
||||
If your dependency graph is empty, there may be a problem with the file containing your dependencies. Check the file to ensure that it's correctly formatted for the file type.
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" %}
|
||||
{% ifversion fpt %}
|
||||
If the file is correctly formatted, then check its size. The dependency graph ignores individual manifest and lock files that are over 0.5 Mb, unless you are a {% data variables.product.prodname_enterprise %} user. It processes up to 20 manifest or lock files per repository by default, so you can split dependencies into smaller files in subdirectories of the repository.{% endif %}
|
||||
|
||||
If a manifest or lock file is not processed, its dependencies are omitted from the dependency graph and they can't be checked for vulnerable dependencies.
|
||||
@@ -109,7 +109,7 @@ If a manifest or lock file is not processed, its dependencies are omitted from t
|
||||
## Further reading
|
||||
|
||||
- "[About the dependency graph](/github/visualizing-repository-data-with-graphs/about-the-dependency-graph)"
|
||||
- "[Viewing and updating vulnerable dependencies in your repository](/github/managing-security-vulnerabilities/viewing-and-updating-vulnerable-dependencies-in-your-repository)"{% if currentVersion == "free-pro-team@latest" %}
|
||||
- "[Viewing and updating vulnerable dependencies in your repository](/github/managing-security-vulnerabilities/viewing-and-updating-vulnerable-dependencies-in-your-repository)"{% ifversion fpt %}
|
||||
- "[Viewing insights for your organization](/organizations/collaborating-with-groups-in-organizations/viewing-insights-for-your-organization)"
|
||||
- "[Understanding how {% data variables.product.product_name %} uses and protects your data](/github/understanding-how-github-uses-and-protects-your-data)"
|
||||
{% endif %}
|
||||
|
||||
@@ -1,8 +1,8 @@
|
||||
---
|
||||
title: Understanding your software supply chain
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=3.0'
|
||||
fpt: '*'
|
||||
ghes: '>=3.0'
|
||||
topics:
|
||||
- Dependency graph
|
||||
- Dependencies
|
||||
|
||||
Reference in New Issue
Block a user