Skip to main content

About Dependabot security updates

Dependabot can fix vulnerable dependencies for you by raising pull requests with security updates.

注意:站点管理员必须先为 your GitHub Enterprise Server instance设置 Dependabot updates,然后你才能使用此功能。 有关详细信息,请参阅“对企业启用 Dependabot”。

About Dependabot security updates

Dependabot security updates make it easier for you to fix vulnerable dependencies in your repository. If you enable this feature, when a Dependabot alert is raised for a vulnerable dependency in the dependency graph of your repository, Dependabot automatically tries to fix it. For more information, see "About Dependabot alerts" and "Configuring Dependabot security updates."

GitHub may send Dependabot alerts to repositories affected by a vulnerability disclosed by a recently published GitHub security advisory. 有关详细信息,请参阅“在 GitHub Advisory Database 中浏览安全公告”。

Dependabot checks whether it's possible to upgrade the vulnerable dependency to a fixed version without disrupting the dependency graph for the repository. Then Dependabot raises a pull request to update the dependency to the minimum version that includes the patch and links the pull request to the Dependabot alert, or reports an error on the alert. For more information, see "Troubleshooting Dependabot errors."

The Dependabot security updates feature is available for repositories where you have enabled the dependency graph and Dependabot alerts. You will see a Dependabot alert for every vulnerable dependency identified in your full dependency graph. However, security updates are triggered only for dependencies that are specified in a manifest or lock file. For more information, see "About the dependency graph."

You can enable a related feature, Dependabot version updates, so that Dependabot raises pull requests to update the manifest to the latest version of the dependency, whenever it detects an outdated dependency. For more information, see "About Dependabot version updates."

当 Dependabot 提出拉取请求时,这些拉取请求可以是安全更新或版本更新:

  • Dependabot security updates 是自动拉取请求,可帮助你更新已知漏洞的信赖项。
  • Dependabot version updates 是自动拉取请求,即使它们没有任何漏洞,也会保持更新依赖项。 要检查版本更新的状态,请依次导航到仓库的 Insights(见解)选项卡、Dependency Graph(依赖关系图)、Dependabot。

GitHub Actions 为 ,Dependabot version updates 和 Dependabot security updates 在 GitHub Enterprise Server 上运行。 启用 Dependabot updates 之前,必须配置 your GitHub Enterprise Server instance 以使用具有自托管运行器的 GitHub Actions。有关详细信息,请参阅“为企业启用 Dependabot”。

About pull requests for security updates

Each pull request contains everything you need to quickly and safely review and merge a proposed fix into your project. This includes information about the vulnerability like release notes, changelog entries, and commit details. Details of which vulnerability a pull request resolves are hidden from anyone who does not have access to Dependabot alerts for the repository.

When you merge a pull request that contains a security update, the corresponding Dependabot alert is marked as resolved for your repository. For more information about Dependabot pull requests, see "Managing pull requests for dependency updates."

注意:最好制定自动测试和验收流程,以便在合并拉取请求之前执行检查。 如果建议的升级版本包含额外的功能,或者更改会中断您的项目代码,这种做法尤其重要。 有关持续集成的详细信息,请参阅“关于持续集成”。

About notifications for Dependabot security updates

You can filter your notifications on GitHub to show Dependabot security updates. For more information, see "Managing notifications from your inbox."