About notifications for vulnerable dependencies
When Dependabot detects vulnerable dependencies in your repositories, we generate a Dependabot alert and display it on the Security tab for the repository. GitHub notifies the maintainers of affected repositories about the new alert according to their notification preferences. Dependabot is enabled by default on all public repositories. For Dependabot 警报, by default, you will receive Dependabot 警报 by email, grouped by the specific vulnerability.
If you're an organization owner, you can enable or disable Dependabot 警报 for all repositories in your organization with one click. You can also set whether the detection of vulnerable dependencies will be enabled or disabled for newly-created repositories. For more information, see "Managing security and analysis settings for your organization."
Configuring notifications for Dependabot 警报
You can configure notification settings for yourself or your organization from the Manage notifications drop-down shown at the top of each page. For more information, see "Configuring notifications."
您可以选择传送您所关注的仓库中Dependabot 警报的方式，以及您接收通知的频率。
默认情况下，您将收到新 Dependabot 警报 的通知：
- 通过电子邮件收到通知， 每次发现关键或严重性高的漏洞时都会发送电子邮件（每次发现漏洞时发送电子邮件选项）
- 在用户界面中接收通知，如有任何漏洞依赖项，将在仓库的文件和代码视图中显示警告（UI 警报选项）
- 在命令行上接收通知，当您推送到具有任何漏洞依赖项的仓库时，警告将显示为回叫（命令行选项）
- 在收件箱中收到通知，关键或严重性高的新漏洞会显示 Web 通知（Web 选项） 您可以自定义您接收
Dependabot 警报 的通知。 例如，您可以使用 Email a digest summary of vulnerabilities（以电子邮件发送漏洞摘要）和 Weekly security email digest（每周安全性电子邮件摘要）选项通过电子邮件接收最多 10 个仓库的每周警报摘要。
Note: You can filter your notifications on GitHub to show Dependabot alerts. For more information, see "Managing notifications from your inbox."
影响一个或多个仓库的Dependabot 警报电子邮件通知包含 X-GitHub-Severity 标头字段。 您可以使用 X-GitHub-Severity 标头字段的值过滤Dependabot 警报的电子邮件通知。 For more information, see "Configuring notifications."
How to reduce the noise from notifications for vulnerable dependencies
If you are concerned about receiving too many notifications for Dependabot 警报, we recommend you opt into the weekly email digest, or turn off notifications while keeping Dependabot 警报 enabled. You can still navigate to see your Dependabot 警报 in your repository's Security tab. For more information, see "Viewing and updating vulnerable dependencies in your repository."