Viewing and updating Dependabot alerts

La pestaña de Las alertas del dependabot de tu repositorio lista todas lasLas alertas del dependabot abiertas y cerradas, así como las Actualizaciones de seguridad del dependabot correspondientes. Puedes filtrar las alertas por paquete, ecosistema o manifiesto. You can sort the list of alerts, and you can click into specific alerts for more details. You can also dismiss or reopen alerts, either one by one or by selecting multiple alerts at once. For more information, see "About Las alertas del dependabot."

Puedes habilitar las alertas de seguridad automáticas para cualquier repositorio que utilice Las alertas del dependabot y la gráfica de dependencias. Para obtener más información, consulta la sección "Acerca de las Actualizaciones de seguridad del dependabot".

Acerca de las actualizaciones para las dependencias vulnerables en tu repositorio

GitHub Enterprise Cloud generates Las alertas del dependabot when we detect that your codebase is using dependencies with known security risks. Para los repositorios en donde se habilitan las Actualizaciones de seguridad del dependabot cuando GitHub Enterprise Cloud detecta una dependencia vulnerable en la rama predeterminada, Dependabot crea una solicitud de cambios para arreglarla. La solicitud de extracción mejorará la dependencia a la versión segura mínima que sea posible y necesaria para evitar la vulnerabilidad.

Puedes clasificar y filtrar las Las alertas del dependabot con los menús desplegables en la pestaña de Las alertas del dependabot o tecleando filtros tales como pares de key:value en la barra de búsqueda. The available filters are repository (for example, repo:my-repository), package (for example, package:django), ecosystem (for example, ecosystem:npm), manifest (for example, manifest:webwolf/pom.xml), state (for example, is:open), and whether an advisory has a patch (for example, has: patch). You can also filter alerts with dependency scope data using scope, for example: scope:development or scope:runtime. With scope:development, the list of alerts will only show dependencies used during development, not production.

Cada alerta del Dependabot tiene un identificador numérico único y la pestaña de Las alertas del dependabot lista una alerta por cada vulnerabilidad detectada. Las Las alertas del dependabot tradicionales agrupan vulnerabilidades por dependencia y generan una sola alerta por dependencia. Si navegas a una alerta tradicional del Dependabot, se te redirigirá a una pestaña de Las alertas del dependabot filtradas para este paquete.

Supported ecosystems and manifests for dependency scope

The table below summarizes whether dependency scope is supported for various ecosystems and manifests, that is, whether Dependabot can identify if a dependency is used for development or production.

Lenguaje	Ecosystem	Manifest file	Dependency scope supported
Go	Módulos de Go	go.mod	No, defaults to runtime
Go	Módulos de Go	go.sum	No, defaults to runtime
Java	Maven	pom.xml	✔ test maps to development, else scope defaults to runtime
JavaScript	npm	package.json	✔
JavaScript	npm	package-lock.json	✔
JavaScript	yarn v1	yarn.lock	No, defaults to runtime
PHP	Composer	composer.json	✔
PHP	Composer	composer.lock	✔
Python	Poetry	poetry.lock	✔
Python	Poetry	pyproject.toml	✔
Python	pip	requirements.txt	✔ Scope is development if the filename contains test or dev, else it is runtime
Python	pip	pipfile.lock	✔
Python	pip	pipfile	✔
Ruby	RubyGems	Gemfile	✔
Ruby	RubyGems	Gemfile.lock	No, defaults to runtime
Rust	Cargo	Cargo.toml	✔
Rust	Cargo	Cargo.lock	No, defaults to runtime
YAML	GitHub Actions	-	No, defaults to runtime
.NET (C#, F#, VB, etc.)	NuGet	.csproj / .vbproj .vcxproj / .fsproj	No, defaults to runtime
.NET	NuGet	packages.config	No, defaults to runtime
.NET	NuGet	.nuspec	✔ When the tag != runtime

Alerts for packages listed as development dependencies are marked with the Development label on the Las alertas del dependabot page and are also available for filtering via the scope filter.

The alert details page of alerts on development-scoped packages shows a "Tags" section containing a Development label.

About the detection of calls to vulnerable functions

When Dependabot tells you that your repository uses a vulnerable dependency, you need to determine what the vulnerable functions are and check whether you are using them. Once you have this information, then you can determine how urgently you need to upgrade to a secure version of the dependency.

For supported languages, Dependabot automatically detects whether you use a vulnerable function and adds the label "Vulnerable call" to affected alerts. You can use this information in the Las alertas del dependabot view to triage and prioritize remediation work more effectively.

You can filter the view to show only alerts where Dependabot detected at least one call to a vulnerable function using the has:vulnerable-calls filter in the search field.

For alerts where vulnerable calls are detected, the alert details page shows additional information:

• One or more code blocks showing where the function is used.
• An annotation listing the function itself, with a link to the line where the function is called.

For more information, see "Reviewing and fixing alerts" below.

Viewing Las alertas del dependabot

1. En GitHub.com, visita la página principal del repositorio.

2. Debajo de tu nombre de repositorio, da clic en Seguridad.

3. En la barra lateral de seguridad, da clic en Las alertas del dependabot. Si no encuentras esta opción, significa que no tienes acceso a las alertas de seguridad y necesitas que te lo otorguen. Para obtener más información, consulta la sección "Administrar los ajustes de seguridad y análisis de tu repositorio".

4. Opcionalmente, para filtrar alertas, selecciona el menú desplegable de Repositorio, l Paquete, Ecosistema o Manifiesto y luego haz clic en el filtro que te gustaría aplicar. También puedes teclear filtros en la barra de búsqueda. For example, ecosystem:npm, has:patch or scope:development. Para ordenar las alertas, selecciona el menú desplegable Ordenar y luego haz clic en la opción por la cual te gustaría ordenarlas.

   You can also click a label on an alert to only show alerts of that type. For example, clicking the Development label in the list of alerts will only show alerts relating to dependencies used in development, not production. For information about the list of ecosystems supported, see "Supported ecosystems and manifests for dependency scope ."

   

5. Click the alert that you would like to view.

Reviewing and fixing alerts

It’s important to ensure that all of your dependencies are clean of any security weaknesses. When Dependabot discovers vulnerabilities or malware in your dependencies, you should assess your project’s level of exposure and determine what remediation steps to take to secure your application.

If a patched version of the dependency is available, you can generate a Dependabot pull request to update this dependency directly from a Dependabot alert. If you have Actualizaciones de seguridad del dependabot enabled, the pull request may be linked will in the Dependabot alert.

In cases where a patched version is not available, or you can’t update to the secure version, Dependabot shares additional information to help you determine next steps. When you click through to view a Dependabot alert, you can see the full details of the security advisory for the dependency including the affected functions. You can then check whether your code calls the impacted functions. This information can help you further assess your risk level, and determine workarounds or if you’re able to accept the risk represented by the security advisory.

For supported languages, Dependabot detects calls to vulnerable functions for you. When you view an alert labeled as "Vulnerable call", the details include the name of the function and a link to the code that calls it. Often you will be able to take decisions based on this information, without exploring further.

Fixing vulnerable dependencies

1. Ver los detalles de una alerta. For more information, see "Viewing Las alertas del dependabot" (above).

2. If you have Actualizaciones de seguridad del dependabot enabled, there may be a link to a pull request that will fix the dependency. Alternatively, you can click Create Dependabot security update at the top of the alert details page to create a pull request.

3. Optionally, if you do not use Actualizaciones de seguridad del dependabot, you can use the information on the page to decide which version of the dependency to upgrade to and create a pull request to update the dependency to a secure version.

4. Cuando estés listo para actualizar tu dependencia y resolver la vulnerabilidad, fusiona la solicitud de extracción.

   Each pull request raised by Dependabot includes information on commands you can use to control Dependabot. For more information, see "Managing pull requests for dependency updates."

Dismissing Las alertas del dependabot

If you schedule extensive work to upgrade a dependency, or decide that an alert does not need to be fixed, you can dismiss the alert. Dismissing alerts that you have already assessed makes it easier to triage new alerts as they appear.

1. Ver los detalles de una alerta. For more information, see "Viewing vulnerable dependencies" (above).
2. Select the "Dismiss" dropdown, and click a reason for dismissing the alert. Unfixed dismissed alerts can be reopened later.

Descartar varias alertas al mismo tiempo

1. View the open Las alertas del dependabot. For more information, see "Viewing Las alertas del dependabot".
2. Optionally, filter the list of alerts by selecting a dropdown menu, then clicking the filter that you would like to apply. También puedes teclear filtros en la barra de búsqueda.
3. To the left of each alert title, select the alerts that you want to dismiss.
4. Optionally, at the top of the list of alerts, select all alerts on the page.
5. Select the "Dismiss alerts" dropdown, and click a reason for dismissing the alerts.

Viewing and updating closed alerts

1. En GitHub.com, visita la página principal del repositorio.
2. Debajo de tu nombre de repositorio, da clic en Seguridad.
3. En la barra lateral de seguridad, da clic en Las alertas del dependabot. Si no encuentras esta opción, significa que no tienes acceso a las alertas de seguridad y necesitas que te lo otorguen. Para obtener más información, consulta la sección "Administrar los ajustes de seguridad y análisis de tu repositorio".
4. Para solo ver las alertas cerradas, haz clic en Cerrada.
5. Haz clic en la alerta que te gustaría ver o actualizar.
6. Optionally, if the alert was dismissed and you wish to reopen it, click Reopen. Alerts that have already been fixed cannot be reopened.

Reopening multiple alerts at once

1. View the closed Las alertas del dependabot. For more information, see "Viewing and updating closed alerts" (above).
2. To the left of each alert title, select the alerts that you want to reopen.
3. Optionally, at the top of the list of alerts, select all closed alerts on the page.
4. Click Reopen to reopen the alerts. Alerts that have already been fixed cannot be reopened.