Dependabot security updates について
Dependabot security updates make it easier for you to fix vulnerable dependencies in your repository. If you enable this feature, when a Dependabot alert is raised for a vulnerable dependency in the dependency graph of your repository, Dependabot automatically tries to fix it. For more information, see "About alerts for vulnerable dependencies" and "Configuring Dependabot security updates."
Dependabot checks whether it's possible to upgrade the vulnerable dependency to a fixed version without disrupting the dependency graph for the repository. Then Dependabot raises a pull request to update the dependency to the minimum version that includes the patch and links the pull request to the Dependabot alert, or reports an error on the alert. For more information, see "Troubleshooting Dependabot errors."
注釈
The Dependabot security updates feature is available for repositories where you have enabled the dependency graph and Dependabot alerts. You will see a Dependabot alert for every vulnerable dependency identified in your full dependency graph. However, security updates are triggered only for dependencies that are specified in a manifest or lock file. Dependabot is unable to update an indirect or transitive dependency that is not explicitly defined. 詳しい情報については、「依存関係グラフについて」を参照してください。
About pull requests for security updates
Each pull request contains everything you need to quickly and safely review and merge a proposed fix into your project. これには、リリースノート、変更ログエントリ、コミットの詳細などの脆弱性に関する情報が含まれます。 Details of which vulnerability a pull request resolves are hidden from anyone who does not have access to Dependabot alerts for the repository.
When you merge a pull request that contains a security update, the corresponding Dependabot alert is marked as resolved for your repository. For more information about Dependabot pull requests, see "Managing pull requests for dependency updates."
Note: It's good practice to have automated tests and acceptance processes in place so that checks are carried out before the pull request is merged. This is particularly important if the suggested version to upgrade to contains additional functionality, or a change that breaks your project's code. For more information about continuous integration, see "About continuous integration."
互換性スコアについて
Dependabot security updates may include compatibility scores to let you know whether updating a vulnerability could cause breaking changes to your project. These are calculated from CI tests in other public repositories where the same security update has been generated. An update's compatibility score is the percentage of CI runs that passed when updating between specific versions of the dependency.
About notifications for Dependabot security updates
You can filter your notifications on GitHub to show Dependabot security updates. 詳しい情報については「インボックスからの通知の管理」を参照してください。