Skip to main content

About Dependabot security updates

Dependabot can fix vulnerable dependencies for you by raising pull requests with security updates.

Note: Dependabot security and version updates are currently in public beta and subject to change.

注: この機能を使用するには、サイト管理者が your GitHub Enterprise Server instanceの Dependabot updatesを設定する必要があります。 詳細については、「エンタープライズでの Dependabot の有効化」を参照してください。

About Dependabot security updates

Dependabot security updates make it easier for you to fix vulnerable dependencies in your repository. If you enable this feature, when a Dependabot alert is raised for a vulnerable dependency in the dependency graph of your repository, Dependabot automatically tries to fix it. For more information, see "About Dependabot alerts" and "Configuring Dependabot security updates."

GitHub may send Dependabot alerts to repositories affected by a vulnerability disclosed by a recently published GitHub security advisory. 詳しくは、「GitHub Advisory Database でのセキュリティ アドバイザリの参照」をご覧ください。

Dependabot checks whether it's possible to upgrade the vulnerable dependency to a fixed version without disrupting the dependency graph for the repository. Then Dependabot raises a pull request to update the dependency to the minimum version that includes the patch and links the pull request to the Dependabot alert, or reports an error on the alert. For more information, see "Troubleshooting Dependabot errors."

The Dependabot security updates feature is available for repositories where you have enabled the dependency graph and Dependabot alerts. You will see a Dependabot alert for every vulnerable dependency identified in your full dependency graph. However, security updates are triggered only for dependencies that are specified in a manifest or lock file. For more information, see "About the dependency graph."

You can enable a related feature, Dependabot version updates, so that Dependabot raises pull requests to update the manifest to the latest version of the dependency, whenever it detects an outdated dependency. For more information, see "About Dependabot version updates."

Dependabot によって pull request が発生する場合、その pull request は、"セキュリティ" 更新プログラムか "バージョン" アップデートを対象としたものである可能性があります。

  • Dependabot security updates は、既知の脆弱性を持つ依存関係を更新するのに役立つ、自動化された pull request です。
  • Dependabot version updates は、依存関係に脆弱税がなくても、依存関係を最新の状態に維持する、自動化された pull request です。 バージョンアップデートの状態をチェックするには、リポジトリのInsights(インサイト)タブ、続いてDependency Graph(依存関係グラフ)、そしてDependabotにアクセスしてください。

GitHub Actions is required for Dependabot version updates and Dependabot security updates to run on GitHub Enterprise Server. Before you enable Dependabot updates, you must configure your GitHub Enterprise Server instance to use GitHub Actions with self-hosted runners. For more information, see "Enabling Dependabot for your enterprise."

About pull requests for security updates

Each pull request contains everything you need to quickly and safely review and merge a proposed fix into your project. This includes information about the vulnerability like release notes, changelog entries, and commit details. Details of which vulnerability a pull request resolves are hidden from anyone who does not have access to Dependabot alerts for the repository.

When you merge a pull request that contains a security update, the corresponding Dependabot alert is marked as resolved for your repository. For more information about Dependabot pull requests, see "Managing pull requests for dependency updates."

注: 自動テストと受け入れプロセスを用意しておいて、pull request がマージされる前にチェックが実行されるようにすることをお勧めします。 これは特に、アップグレードが提案されたバージョンに追加機能があったり、プロジェクトのコードを破壊するような変更がある場合に重要です。 継続的インテグレーションの詳細については、「継続的インテグレーションについて」を参照してください。

About notifications for Dependabot security updates

You can filter your notifications on GitHub to show Dependabot security updates. For more information, see "Managing notifications from your inbox."