Dependabot quickstart guide

Find and fix vulnerable dependencies you rely on with Dependabot.

Qui peut utiliser cette fonctionnalité ?

Dependabot alerts are available for organization-owned and user-owned repositories.

Dans cet article

About Dependabot

This quickstart guide walks you through setting up and enabling Dependabot, viewing Dependabot alerts, and updating your repository to use a secure version of the dependency.

Dependabot se compose de trois fonctionnalités différentes qui vous aident à gérer vos dépendances :

  • Dependabot alerts : Vous informe des vulnérabilités dans les dépendances que vous utilisez dans votre référentiel.
  • Dependabot security updates : Lancer automatiquement des demandes de mise à jour des dépendances que vous utilisez et qui présentent des vulnérabilités de sécurité connues.
  • Dependabot version updates : Lancer automatiquement des demandes de tirage pour maintenir vos dépendances à jour.

Prerequisites

For the purpose of this guide, we're going to use a demo repository to illustrate how Dependabot finds vulnerabilities in dependencies, where you can see Dependabot alerts on GitHub, and how you can explore, fix, or dismiss these alerts.

You need to start by forking the demo repository.

  1. Navigate to https://github.com/dependabot/demo.
  2. At the top of the page, on the right, click Fork.
  3. Select an owner (you can select your GitHub personal account) and type a repository name. For more information about forking repositories, see Dupliquer (fork) un référentiel.
  4. Click Create fork.

Enabling Dependabot for your repository

You need to follow the steps below on the repository you forked in Prerequisites.

  1. Sur GitHub, accédez à la page principale du référentiel.

  2. Sous le nom de votre référentiel, cliquez sur Paramètres. Si vous ne voyez pas l’onglet « Paramètres », sélectionnez le menu déroulant , puis cliquez sur Paramètres.

    Capture d’écran d’un en-tête de dépôt montrant les onglets. L’onglet « Paramètres » est mis en évidence avec un encadré orange foncé.

  3. Dans la section « Sécurité » de la barre latérale, cliquez sur Advanced Security.

  4. Under "Dependabot", click Enable for Dependabot alerts, Dependabot security updates, and Dependabot version updates.

  5. If you clicked Enable for Dependabot version updates, you can edit the default dependabot.yml configuration file that GitHub creates for you in the /.github directory of your repository. To enable Dependabot version updates for your repository, you typically configure this file to suit your needs by editing the default file, and committing your changes. You can refer to the snippet provided in Configuration de mises à jour de version Dependabot for an example.

Remarque

If the dependency graph is not already enabled for the repository, GitHub will enable it automatically when you enable Dependabot.

For more information about configuring each of these Dependabot features, see Configuration d’alertes Dependabot, Configuration des mises à jour de sécurité Dependabot, and Configuration de mises à jour de version Dependabot.

Viewing Dependabot alerts for your repository

If Dependabot alerts are enabled for a repository, you can view Dependabot alerts on the "Security" tab for the repository. You can use the forked repository that you enabled Dependabot alerts on in the previous section.

  1. Sur GitHub, accédez à la page principale du référentiel.

  2. Sous le nom du référentiel, cliquez sur Sécurité. Si vous ne voyez pas l’onglet « Sécurité », sélectionnez le menu déroulant et cliquez sur Sécurité.

    Capture d’écran d’un en-tête de dépôt montrant les onglets. L’onglet « Sécurité » est mis en évidence avec un encadré orange foncé.

  3. Dans la barre latérale « Alertes de vulnérabilité » de la vue d’ensemble de la sécurité, cliquez sur Dependabot . Si cette option est absente, cela signifie que vous n'avez pas accès aux alertes de sécurité et que vous devez y avoir accès. Pour plus d'informations, voir Gestion des paramètres de sécurité et d’analyse pour votre dépôt.

    Capture d’écran de la vue d’ensemble de la sécurité, avec l’onglet « Dependabot » mis en évidence avec un contour orange foncé.

  4. Review the open alerts on the Dependabot alerts page. By default, the page displays the Open tab, listing the open alerts. (You'll be able to view any closed alerts by clicking Closed.)

    Screenshot showing the list of Dependabot alerts for the demo repository.

    You can filter Dependabot alerts in the list, using a variety of filters or labels. For more information, see Affichage et mise à jour des alertes Dependabot. You can also use Règles de triage automatique de Dependabot to filter out false positive alerts or alerts you're not interested in. For more information, see À propos des règles de triage automatique de Dependabot.

  5. Click the "Command Injection in lodash" alert on the javascript/package-lock.json file. The details page for the alert will show the following information (note that some information may not apply to all alerts):

    • Whether Dependabot created a pull request that will fix the vulnerability. You can review the suggested security update by clicking Review security update.
    • Package involved
    • Affected versions
    • Patched version
    • Brief description of the vulnerability

    Screenshot of the detailed page of an alert in the demo repository, showing the main information.

  6. Optionally, you can also explore the information on the right-side of the page. Some of the information shown in the screenshot may not apply to every alert.

    • Severity
    • CVSS metrics: We use CVSS levels to assign severity levels. For more information, see À propos de la base de données GitHub Advisory.
    • Tags
    • Weaknesses: List of CWEs related to the vulnerability, if applicable
    • CVE ID: Unique CVE identifier for the vulnerability, if applicable
    • GHSA ID: Unique identifier of the corresponding advisory on the GitHub Advisory Database. For more information, see À propos de la base de données GitHub Advisory.
    • Option to navigate to the advisory on the GitHub Advisory Database
    • Option to see all of your repositories that are affected by this vulnerability
    • Option to suggest improvements for this advisory on the GitHub Advisory Database

    Screenshot of the detailed page of an alert in the demo repository, showing the information displayed on the right-side of the page.

For more information about viewing, prioritizing, and sorting Dependabot alerts, see Affichage et mise à jour des alertes Dependabot.

Fixing or dismissing a Dependabot alert

You can fix or dismiss Dependabot alerts on GitHub. Let's continue to use the forked repository as an example, and the "Command Injection in lodash" alert described in the previous section.

  1. Navigate to the Dependabot alerts tab for the repository. For more information, see the Viewing Dependabot alerts for your repository section above.
  2. Click an alert.
  3. Click the "Command Injection in lodash" alert on the javascript/package-lock.json file.
  4. Review the alert. You can:

    • Review the suggested security update by clicking Review security update. This will open the pull request generated by Dependabot with the security fix.

      Screenshot of the pull request generated by Dependabot to fix the security vulnerability highlighted by the selected alert.

      • On the pull request description, you can click Commits to explore the commits included in the pull request.
      • You can also click Dependabot commands and options to learn about the commands that you can use to interact with the pull request.
      • When you're ready to update your dependency and resolve the vulnerability, merge the pull request.

    • If you decide that you want to dismiss the alert

      • Go back to the alert details page.

      • On the top-right corner, click Dismiss alert.

        Screenshot of the alert details page with the Dismiss alert button, dropdown menu options, and dismissal comment box outlined in orange.

      • Select a reason for dismissing the alert.

      • Optionally, add a dismissal comment. The dismissal comment will be added to the alert timeline and can be used as justification during auditing and reporting.

      • Click Dismiss alert. The alert won't appear anymore in the Open tab of the alert list, and you are able to view it in the Closed tab.

For more information about reviewing and updating Dependabot alerts, see Affichage et mise à jour des alertes Dependabot.

Troubleshooting

You may need to do some troubleshooting if:

  • Dependabot is blocked from creating a pull request to fix an alert, or
  • The information reported by Dependabot is not what you expect.

For more information, see Résolution des erreurs Dependabot and Résolution des problèmes de détection des dépendances vulnérables, respectively.

Next steps

For more information about configuring Dependabot updates, see Configuration des mises à jour de sécurité Dependabot and Configuration de mises à jour de version Dependabot.

For more information about configuring Dependabot for an organization, see Configuration d’alertes Dependabot.

For more information about viewing pull requests opened by Dependabot, see Gestion des demandes de tirage (pull request) pour les mises à jour des dépendances.

For more information about the security advisories that contribute to Dependabot alerts, see Exploration des avis de sécurité dans la base de données GitHub Advisory.

For more information about configuring notifications about Dependabot alerts, see Configuration de notifications pour les alertes Dependabot.