8.2 KiB
title, intro, shortTitle, versions, type, topics
| title | intro | shortTitle | versions | type | topics | ||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Configuring Dependabot alerts | Enable {% data variables.product.prodname_dependabot_alerts %} to be generated when a new vulnerable dependency {% ifversion GH-advisory-db-supports-malware %}or malware {% endif %}is found in one of your repositories. | Configure Dependabot alerts |
|
how_to |
|
About {% data variables.product.prodname_dependabot_alerts %} for vulnerable dependencies{% ifversion GH-advisory-db-supports-malware %} and malware{% endif %}
{% data reusables.repositories.a-vulnerability-is %}
{% data variables.product.prodname_dependabot %} scans code when a new advisory is added to the {% data variables.product.prodname_advisory_database %} or the dependency graph for a repository changes. When vulnerable dependencies{% ifversion GH-advisory-db-supports-malware %} or malware{% endif %} are detected, {% data variables.product.prodname_dependabot_alerts %} are generated. For more information, see "About {% data variables.product.prodname_dependabot_alerts %}."
You can enable or disable {% data variables.product.prodname_dependabot_alerts %} for:
- Your personal account
- Your repository
- Your organization
Managing {% data variables.product.prodname_dependabot_alerts %} for your personal account
{% ifversion fpt or ghec %}
You can enable or disable {% data variables.product.prodname_dependabot_alerts %} for all repositories owned by your personal account.
Enabling or disabling {% data variables.product.prodname_dependabot_alerts %} for existing repositories
{% data reusables.user-settings.access_settings %}
{% data reusables.user-settings.security-analysis %}
3. Under "Code security and analysis", to the right of {% data variables.product.prodname_dependabot_alerts %}, click Disable all or Enable all.
4. Optionally, enable {% data variables.product.prodname_dependabot_alerts %} by default for new repositories that you create.
5. Click Disable {% data variables.product.prodname_dependabot_alerts %} or Enable {% data variables.product.prodname_dependabot_alerts %} to disable or enable {% data variables.product.prodname_dependabot_alerts %} for all the repositories you own.
When you enable {% data variables.product.prodname_dependabot_alerts %} for existing repositories, you will see any results displayed on GitHub within minutes.
Enabling or disabling {% data variables.product.prodname_dependabot_alerts %} for new repositories
{% data reusables.user-settings.access_settings %}
{% data reusables.user-settings.security-analysis %}
3. Under "Code security and analysis", to the right of {% data variables.product.prodname_dependabot_alerts %}, enable or disable {% data variables.product.prodname_dependabot_alerts %} by default for new repositories that you create.
{% else %} {% data variables.product.prodname_dependabot_alerts %} for your repositories can be enabled or disabled by your enterprise owner. For more information, see "Enabling Dependabot for your enterprise."
{% endif %}
Managing {% data variables.product.prodname_dependabot_alerts %} for your repository
{% ifversion fpt or ghec %}You can manage {% data variables.product.prodname_dependabot_alerts %} for your public, private or internal repository.
By default, we notify people with admin permissions in the affected repositories about new {% data variables.product.prodname_dependabot_alerts %}. {% data variables.product.product_name %} never publicly discloses insecure dependencies for any repository. You can also make {% data variables.product.prodname_dependabot_alerts %} visible to additional people or teams working on repositories that you own or have admin permissions for.
{% data reusables.security.security-and-analysis-features-enable-read-only %}
Enabling or disabling {% data variables.product.prodname_dependabot_alerts %} for a repository
{% data reusables.repositories.navigate-to-repo %} {% data reusables.repositories.sidebar-settings %} {% data reusables.repositories.navigate-to-code-security-and-analysis %}
- Under "Code security and analysis", to the right of {% data variables.product.prodname_dependabot_alerts %}, click Enable to enable alerts or Disable to disable alerts.
{% endif %}{% ifversion ghes or ghae %}
{% data variables.product.prodname_dependabot_alerts %} for your repository can be enabled or disabled by your enterprise owner. For more information, see "Enabling Dependabot for your enterprise." {% endif %}
Managing {% data variables.product.prodname_dependabot_alerts %} for your organization
{% ifversion fpt or ghec %}You can enable or disable {% data variables.product.prodname_dependabot_alerts %} for all repositories owned by your organization. Your changes affect all repositories.
Enabling or disabling {% data variables.product.prodname_dependabot_alerts %} for all existing repositories
{% data reusables.profile.access_org %}
{% data reusables.profile.org_settings %}
{% data reusables.organizations.security-and-analysis %}
2. Under "Code security and analysis", to the right of {% data variables.product.prodname_dependabot_alerts %}, click Disable all or Enable all.
{% ifversion fpt or ghec %}
{% endif %}
{% ifversion ghae %}
{% endif %}
{% ifversion fpt or ghec %}
3. Optionally, enable {% data variables.product.prodname_dependabot_alerts %} by default for new repositories in your organization.
{% ifversion fpt or ghec %}
{% endif %}
{% endif %}
{% ifversion fpt or ghec %}
4. Click Disable {% data variables.product.prodname_dependabot_alerts %} or Enable {% data variables.product.prodname_dependabot_alerts %} to disable or enable {% data variables.product.prodname_dependabot_alerts %} for all the repositories in your organization.
{% ifversion fpt or ghec %}
{% endif %}{% endif %}{% endif %}{% ifversion ghes or ghae %}
{% data variables.product.prodname_dependabot_alerts %} for your organization can be enabled or disabled by your enterprise owner. For more information, see "About Dependabot for GitHub Enterprise Server."
{% endif %}