|
|
|
|
@@ -32,14 +32,14 @@ This quickstart guide walks you through setting up and enabling {% data variable
|
|
|
|
|
Before you can use the {% data variables.product.prodname_dependabot_alerts %} feature in {% data variables.product.product_name %}, you must ensure that your enterprise administator enables {% data variables.product.prodname_dependabot %} for the instance. For more information, see "[AUTOTITLE](/admin/configuration/configuring-github-connect/enabling-dependabot-for-your-enterprise#enabling-dependabot-alerts)."
|
|
|
|
|
{% endif %}
|
|
|
|
|
|
|
|
|
|
For the purpose of this guide, we're going to use a demo repository to illustrate how {% data variables.product.prodname_dependabot %} finds vulnerabilities in dependencies, where you can see {% data variables.product.prodname_dependabot_alerts %} on {% data variables.product.prodname_dotcom %}, and how you can explore, fix, or dismiss these alerts.
|
|
|
|
|
For the purpose of this guide, we're going to use a demo repository to illustrate how {% data variables.product.prodname_dependabot %} finds vulnerabilities in dependencies, where you can see {% data variables.product.prodname_dependabot_alerts %} on {% data variables.product.prodname_dotcom %}, and how you can explore, fix, or dismiss these alerts.
|
|
|
|
|
|
|
|
|
|
You need to start by forking the demo repository.
|
|
|
|
|
|
|
|
|
|
1. Navigate to [https://github.com/dependabot/demo](https://github.com/dependabot/demo).
|
|
|
|
|
1. At the top of the page, on the right, click **{% octicon "repo-forked" aria-hidden="true" %} Fork**.
|
|
|
|
|
1. Select an owner (you can select your {% data variables.product.prodname_dotcom %} personal account) and type a repository name. For more information about forking repositories, see "[AUTOTITLE](/get-started/quickstart/fork-a-repo#forking-a-repository)."
|
|
|
|
|
1. Click **Create fork**.
|
|
|
|
|
1. Click **Create fork**.
|
|
|
|
|
|
|
|
|
|
## Enabling {% data variables.product.prodname_dependabot %} for your repository
|
|
|
|
|
|
|
|
|
|
@@ -70,7 +70,7 @@ If {% data variables.product.prodname_dependabot_alerts %} are enabled for a rep
|
|
|
|
|
|
|
|
|
|

|
|
|
|
|
|
|
|
|
|
You can filter {% data variables.product.prodname_dependabot_alerts %} in the list, using a variety of filters or labels. For more information, see "[AUTOTITLE](/code-security/dependabot/dependabot-alerts/viewing-and-updating-dependabot-alerts#prioritizing-dependabot-alerts)."{% ifversion dependabot-alert-rules-auto-dismissal-npm-dev-dependencies %} You can also use {% data variables.product.prodname_dependabot %} alert rules to filter out false positive alerts or alerts you're not interested in. For more information, see "[AUTOTITLE](/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts)."{% endif %}
|
|
|
|
|
You can filter {% data variables.product.prodname_dependabot_alerts %} in the list, using a variety of filters or labels. For more information, see "[AUTOTITLE](/code-security/dependabot/dependabot-alerts/viewing-and-updating-dependabot-alerts#prioritizing-dependabot-alerts)."{% ifversion dependabot-alert-rules-auto-dismissal-npm-dev-dependencies %} You can also use {% data variables.product.prodname_dependabot %} alert rules to filter out false positive alerts or alerts you're not interested in. For more information, see "[AUTOTITLE](/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts)."{% endif %}
|
|
|
|
|
|
|
|
|
|
1. Click the "Command Injection in lodash" alert on the _javascript/package-lock.json_ file. The details page for the alert will show the following information (note that some information may not apply to all alerts):
|
|
|
|
|
- Whether {% data variables.product.prodname_dependabot %} created a pull request that will fix the vulnerability. You can review the suggested security update by clicking **Review security update**.
|
|
|
|
|
@@ -83,11 +83,11 @@ If {% data variables.product.prodname_dependabot_alerts %} are enabled for a rep
|
|
|
|
|
|
|
|
|
|
1. Optionally, you can also explore the information on the right-side of the page. Some of the information shown in the screenshot may not apply to every alert.
|
|
|
|
|
- Severity
|
|
|
|
|
- CVSS metrics—we use CVSS levels to assign severity levels. For more information, see "[AUTOTITLE](/code-security/security-advisories/global-security-advisories/about-the-github-advisory-database#about-cvss-levels)."
|
|
|
|
|
- CVSS metrics—we use CVSS levels to assign severity levels. For more information, see "[AUTOTITLE](/code-security/security-advisories/working-with-global-security-advisories-from-the-github-advisory-database/about-the-github-advisory-database#about-cvss-levels)."
|
|
|
|
|
- Tags
|
|
|
|
|
- Weaknesses—list of CWEs related to the vulnerability, if applicable
|
|
|
|
|
- CVE ID—unique CVE identifier for the vulnerability, if applicable
|
|
|
|
|
- GHSA ID—unique identifier of the corresponding advisory on the {% data variables.product.prodname_advisory_database %}. For more information, see "[AUTOTITLE](/code-security/security-advisories/global-security-advisories/about-the-github-advisory-database#about-ghsa-ids)."
|
|
|
|
|
- GHSA ID—unique identifier of the corresponding advisory on the {% data variables.product.prodname_advisory_database %}. For more information, see "[AUTOTITLE](/code-security/security-advisories/working-with-global-security-advisories-from-the-github-advisory-database/about-the-github-advisory-database#about-ghsa-ids)."
|
|
|
|
|
- Option to navigate to the advisory on the {% data variables.product.prodname_advisory_database %}
|
|
|
|
|
- Option to see all of your repositories that are affected by this vulnerability
|
|
|
|
|
- Option to suggest improvements for this advisory on the {% data variables.product.prodname_advisory_database %}
|
|
|
|
|
@@ -99,9 +99,9 @@ For more information about viewing, prioritizing, and sorting {% data variables.
|
|
|
|
|
|
|
|
|
|
You can fix or dismiss {% data variables.product.prodname_dependabot_alerts %} on {% data variables.product.prodname_dotcom %}. Let's continue to use the forked repository as an example, and the "Command Injection in lodash" alert described in the previous section.
|
|
|
|
|
|
|
|
|
|
1. Navigate to the {% data variables.product.prodname_dependabot_alerts %} tab for the repository. For more information, see the "[Viewing {% data variables.product.prodname_dependabot_alerts %} for your repository](#viewing-dependabot-alerts-for-your-repository)" section above.
|
|
|
|
|
1. Navigate to the {% data variables.product.prodname_dependabot_alerts %} tab for the repository. For more information, see the "[Viewing {% data variables.product.prodname_dependabot_alerts %} for your repository](#viewing-dependabot-alerts-for-your-repository)" section above.
|
|
|
|
|
1. Click an alert.
|
|
|
|
|
1. Click the "Command Injection in lodash" alert on the _javascript/package-lock.json_ file.
|
|
|
|
|
1. Click the "Command Injection in lodash" alert on the _javascript/package-lock.json_ file.
|
|
|
|
|
1. Review the alert. You can:
|
|
|
|
|
- Review the suggested security update by clicking **Review security update**. This will open the pull request generated by {% data variables.product.prodname_dependabot %} with the security fix.
|
|
|
|
|
|
|
|
|
|
@@ -134,12 +134,12 @@ For more information, see "[AUTOTITLE](/code-security/dependabot/working-with-de
|
|
|
|
|
|
|
|
|
|
## Next steps
|
|
|
|
|
|
|
|
|
|
For more information about configuring {% data variables.product.prodname_dependabot %} updates, see "[AUTOTITLE](/code-security/dependabot/dependabot-security-updates/configuring-dependabot-security-updates)" and "[AUTOTITLE](/code-security/dependabot/dependabot-version-updates/configuring-dependabot-version-updates)."
|
|
|
|
|
For more information about configuring {% data variables.product.prodname_dependabot %} updates, see "[AUTOTITLE](/code-security/dependabot/dependabot-security-updates/configuring-dependabot-security-updates)" and "[AUTOTITLE](/code-security/dependabot/dependabot-version-updates/configuring-dependabot-version-updates)."
|
|
|
|
|
|
|
|
|
|
For more information about configuring {% data variables.product.prodname_dependabot %} for an organization, see "[AUTOTITLE](/code-security/dependabot/dependabot-alerts/configuring-dependabot-alerts#managing-dependabot-alerts-for-your-organization).
|
|
|
|
|
|
|
|
|
|
For more information about viewing pull requests opened by {% data variables.product.prodname_dependabot %}, see "[AUTOTITLE](/code-security/dependabot/working-with-dependabot/managing-pull-requests-for-dependency-updates#viewing-dependabot-pull-requests)."
|
|
|
|
|
|
|
|
|
|
For more information about the security advisories that contribute to {% data variables.product.prodname_dependabot_alerts %}, see "[AUTOTITLE](/code-security/security-advisories/global-security-advisories/browsing-security-advisories-in-the-github-advisory-database)."
|
|
|
|
|
For more information about the security advisories that contribute to {% data variables.product.prodname_dependabot_alerts %}, see "[AUTOTITLE](/code-security/security-advisories/working-with-global-security-advisories-from-the-github-advisory-database/browsing-security-advisories-in-the-github-advisory-database)."
|
|
|
|
|
|
|
|
|
|
For more information about configuring notifications about {% data variables.product.prodname_dependabot_alerts %}, see "[AUTOTITLE](/code-security/dependabot/dependabot-alerts/configuring-notifications-for-dependabot-alerts)."
|