Dependabot is GitHub's Software Composition Analysis (SCA) tool for visualizing, maintaining, and securing your dependencies in your software supply chain. It is a platform in which many dependency features are derived from.
The dependency graph is a summary of the manifest and lock files stored in a repository. It shows you the ecosystems and packages your codebase depends on (its dependencies) and the repositories and packages that depend on your project (its dependents). The information in the dependency graph is used by dependency review and Dependabot. For more information, see "About the dependency graph."
- Exploring the dependencies of a repository
- Exporting a software bill of materials for your repository
GitHub sends Dependabot alerts when we detect vulnerabilities affecting your repository. The alert is displayed on the Security tab for the repository. The alert includes a link to the affected file in the project, and information about a fixed version. GitHub also notifies the maintainers of the repository, according to their notification preferences. For more information, see "About alerts for vulnerable dependencies."
Security Alerts are populated by the GitHub Advisory Database. The GitHub Advisory Database contains a curated list of security vulnerabilities that have been mapped to packages tracked by the GitHub dependency graph.
When GitHub generates a Dependabot alert for a vulnerable dependency in your repository, Dependabot can automatically try to fix it for you. Dependabot security updates are automatically generated pull requests that update a vulnerable dependency to a fixed version. For more information, see "About Dependabot security updates."
Enabling Dependabot version updates takes the effort out of maintaining your dependencies. With Dependabot version updates, whenever GitHub identifies an outdated dependency, it raises a pull request to update the manifest to the latest version of the dependency. By contrast, Dependabot security updates only raises pull requests to fix vulnerable dependencies. For more information, see "About Dependabot version updates."
Supported repositories and ecosystems
The Dependency submission API lets you submit dependencies for a project. This enables you to add dependencies, such as those resolved when software is compiled or built, to GitHub's dependency graph feature, providing a more complete picture of all of your project's dependencies. These transitive or build-time dependencies are eligible for Dependendabot Alerts/Security Updates.
Prerequisite: Dependency Graph must be enabled to support Dependency Insights.
With Dependency Insights you can view vulnerabilities, licenses, and other important information for the open source projects your organization depends on.
- "Changing the visibility of your organization's dependency insights"
- "Enforcing a policy on dependency insights in your enterprise account"
The Security Overview indicates whether security features are enabled for repositories owned by your organization and consolidates alerts for each feature. Security features include GitHub Advanced Security features, such as code scanning and secret scanning, as well as Dependabot alerts. You can also filter all of the code scanning, secret scanning, and dependabot alerts throughout the organization/enterprise without having to visit individual repositories.
By checking the dependency reviews on pull requests you can avoid introducing vulnerabilities from dependencies into your codebase. If the pull requests adds a vulnerable dependency, or changes a dependency to a vulnerable version, this is highlighted in the dependency review. You can change the dependency to a patched version before merging the pull request. For more information, see "About dependency review."
Dependency Review Enforcement: You can use the Dependency Review GitHub Action in your repository to enforce dependency reviews on your pull requests. The action scans for vulnerable versions of dependencies introduced by package version changes in pull requests, and warns you about the associated security vulnerabilities. This gives you better visibility of what's changing in a pull request, and helps prevent vulnerabilities being added to your repository. It also has the ability to permit/block open source licenses. For more information, see dependency-review-action.
Vulnerable Function Detection - For supported languages (Python), Dependabot automatically detects whether you use a vulnerable function and adds the label "Vulnerable call" to affected alerts. You can use this information in the Dependabot alerts view to triage and prioritize remediation work more effectively.