►
Description
Glenn Wester and Cory Dobson, Solutions Engineers, dive into software dependencies. More effective management of software vulnerabilities enables your organization to consume open source software more responsibly, saving you developer time and effort. Secure your open source supply chain from software vulnerabilities.
Learn more about Security here: https://github.com/learn/security
As always, feel free to leave us a comment below and don't forget to subscribe: http://bit.ly/subgithub
Thanks!
Connect with us.
Facebook: http://fb.com/github
Twitter: http://twitter.com/github
LinkedIn: http://linkedin.com/company/github
About GitHub
GitHub is the best place to share code with friends, co-workers, classmates, and complete strangers. Millions of people use GitHub to build amazing things together. For more info, go to http://github.com
A
So
hello,
everybody
today
is
july.
24Th
we're
going
to
start
the
third
installment
of
the
github
demo
day,
so
welcome
hope,
everybody's
having
a
good
friday,
we'd
love
to
hear
where
you're
calling
in
from
today.
We
know
we
have
a
lot
of
people
around
the
world
and
if
it's
your
evening
thanks
for
joining
us,
if
it's
your
morning,
cheers
get
some
coffee
going
grab
a
beverage
and
we're
gonna
get
started
here
in
just
a
minute.
A
So
quick
agenda
fired
up
vs
code
here,
we'll
start
with
some
quick
intros.
We
should
probably
get
to
know
each
other.
You
know
before
talking
about
each
other's
dependencies.
So
do
some
quick
intros
here
we're
gonna
talk
about
open
source,
of
course
dependencies
the
dependency
graph,
the
insights
you
can
gain
from
looking
at
this
security
vulnerability
alerts
and
then
automated
security
fixes.
A
So
without
further
ado,
let's
get
started
so
I'll
start,
I'm
glenn,
I'm
a
solutions
engineer
here
at
github
quick
background
about
me.
I
started
my
development
career
in
c-sharp
application
development
and
then
I
graduated
to
mobile
development
with
xamarin,
and
then
I
joined
microsoft
and
now
I'm
happily
at
github.
A
So
quick
page
here,
so
we
launched
a
feature
recently
where
you
can
have
a
readme
file,
so
you
can
have
markdown
as
your
profile
page.
So
if
you
haven't
done
this
yet
definitely
take
advantage
of
it.
So
you
can
put
in
cool
gifts
and
whatnot
and
kind
of
make
customize
your
page
here.
I'm
a
big
fan
of
this
feature.
A
One
of
my
big
hobbies
on
the
side
is
astronomy
and
I
think,
by
the
end
of
the
stream
you're
all
going
to
learn
a
couple
things
about
space.
So
for
those
of
you
in
the
northern
hemisphere.
There's
a
comet,
that's
passing
right!
Now,
I'm
sure
that
you've
seen
it
in
the
news-
or
you
know,
maybe
on
instagram
or
something
like
that.
The
comet's
name
is
c2020f3
and
it
was
discovered
by
the
near
earth,
object
wide
field.
Infrared
survey
explorer
neowise.
For
short,
this
is
going
to
be
around
for
the
rest
of
june.
A
You
just
have
to
look
north.
You
know
one
hour
after
sunset,
so
definitely
go
outside
and
do
this
I
highly
encourage
you
to
do
so,
and
hopefully
you
will
after
hearing
this,
but
no
worries.
If
you
don't,
because
it'll
be
back
in
seven
thousand
years,
so
you
know,
if
you
just
want
to
catch
it,
then
just
stick
around
for
it.
Then
this
is
what
it
looks
like
it'll
be
a
little
bit
dimmer
than
this.
But
if
you
use
kind
of
like
a
tracking
mount,
you
can
capture
it.
A
So
we
have
some
other
folks
in
the
line
as
well
from
github.
That
will
be
helping
with
chat
moderation,
and
you
know,
if
anything
is
going
on.
Corey
just
feel
free
to
interrupt
me
as
I'm
talking,
so
we
have
corey
from
the
sc
team
who's
going
to
be
chat,
moderating
and
then
we
also
have
william
from
product
as
well.
I
don't
know
if
you
want
to
say
hi
corey.
B
B
Yeah
hi
folks
welcome.
My
name
is
corey
dobson,
I'm
a
enterprise
solution,
engineer
same
as
glenn,
so
we're
your
sc
team
for
the
day,
gonna
be
digging
into
a
bunch
of
things
around
essentially
securing
your
open
source
code,
I'm
going
to
be
moderating
the
chat
while
clint
is
going
through
some
demos
and
and
of
course,
like
some
some
various
content
around
this.
So
we're
super
excited
we're
looking
forward
to
it.
I'm
in
the
chat
at
corey
dobson
so
feel
free
to
like
ping
me
there.
B
A
Oh
so
there's
one
quick
thing
too!
So
for
those
of
you
that
want
to
actually
be
comment,
hunting,
let
me
get
back
to
astronomy,
real
fast,
so
it's
actually
open
source
software.
Gpl
software,
that's
free!
You
can
type
in
your
gps,
coordinates
and
find
out
exactly
where
to
look.
So
sometimes
I
tell
people
to
go
check
out
this
comment
and
they're
like.
Where
do
I
look
and
I
can't
find
the
dipper?
So
what's
really
cool
is
that
yeah?
The
software
did
do
this
and
kudos
to
those
developers
that
have
built
this.
It's
cross-platform!
A
I
really
mean
that
it's
for
linux,
mac,
windows,
game
boy!
No,
it's
good,
there's
a
web
version
as
well.
So
if
you
want
to
like
just
fire
up
the
web
interface,
you
can
find
out
exactly
where
it's
going
to
be
and
where
you
need
to
stand
and
what
it
will
be
near.
A
couple
quick
answers,
so
here
it
is
2020
f3
near
was
you
don't
need
to
have
binoculars?
You
don't
need
to
have
a
telescope.
Yes,
you
can
see
this
from
a
city.
A
You
just
have
to
go
outside
and
look
so
it's
something
that's
going
to
be
really
cool,
okay
without
further
ado,
let's
get
into
it.
So
I
want
to
talk
about
open
source
first.
So,
a
couple
months
ago
we
had
a
developer
conference
called
satellite.
We
have
two
conferences
per
year:
one's
called
the
universe,
one's
called
satellite,
so
we're
getting
an
audio
comment.
A
B
A
So
I
just
we
had
an
important
milestone.
Our
platform
now
github's
platform
now
has
50
million
developers,
which
is
amazing.
We're
really
excited
about
this
and
we're
continuing
to
see
growth.
So
I
know
we're
on
our
way
to
100
million,
which
is
just
so
super
cool
to
me.
So
first
off
shout
out
to
all
the
open
source
contributors
on
the
line
right
now,
we'd
love
you
to
share
like
what
projects
that
you
happen
to
be
contributing
to
right
now
and
also
shout
out
to
the
maintainers
that
are
on
as
well.
A
If
you
want
to
share
your
link
in
the
chat,
we'll
give
it
a
quick
call
out,
but
we
wouldn't
even
be
having
this
conversation
without
your
contributions.
So
thank
you
for
doing
what
you
do
and
if
you
want
to
check
out
the
announcements
from
the
most
recent
conference
that
we've
had
there's
a
lot
of
cool
stuff.
That's
going
on
here,
my
favorite
being
codespaces,
which
is
a
containerized
development
environment
for
vs
code.
A
So
what
I'm
basically
saying
is
that
you
can
code
on
your
ipad
and
if
you
want
to
go
check
out
more
about
that,
you
can
sign
up
for
the
beta
and
we're
letting
people
in
and
then
for
those
open
source
developers
too.
I
want
to
make
you
aware
that
we
have
a
sponsors
program
as
well.
We
have
a
lot
of
folks
now
that
are
doing
this
full-time
and
you
can
open
up
and
join
the
waitlist
to
monetize
your
account
should
this,
you
know
be
something
that
you
want
to
do
full
time.
A
So
the
software
that
you
contribute
is
extremely
important.
It's
ending
up
in
basically
all
software
that
we're
developing,
and
we
want
to
encourage
people
to
do
this
full
time.
So
you
can
join
the
waitlist
and
join
this
program
if
this
is
something
you
want
to
do
as
your
full-time
job,
so
open
source
is
so
important
in
fact
that
we
recently
just
buried
21
terabytes
of
it
in
the
arctic
circle
in
an
abandoned
coal
mine
in
the
permafrost
in
the
arctic
circle.
A
A
So
what
we
did
here
is
that
this
is
kind
of
like
an
insurance
policy
for
those
of
you
that
are
aware
of
the
arctic
seed
vaults,
it's
kind
of
like
okay.
If
we
need
to
rebuild
society
right,
we're
going
to
need
seeds
to
replant
it
but
open
source
and
software
is
so
important,
and
it's
ending
up
in
everything
that
we
don't
want
to
lose
that
either.
So
our
ceo,
you
know,
had
source
code
essentially,
and
you
know
kudos
to
the
people
that
have
had
their
their
repositories
end
up.
A
You
know
in
the
arctic
code
belt
program.
I
think
the
criteria
was
is
that
it
had
to
be
open
source
with
a
certain
amount
of
stars,
and
we
would
put
it
in
anyways.
We
just
did
this.
We
just
converted
the
source
code
and
made
it
you
know
human
readable
and
put
it
onto
film.
We
buried
it
not
like
metaphorically
buried
it
but
like
like
physically
buried
it
in
this
vault.
So
that
way
as
we're
rebuilding
we
have
seeds
and
then
also
two.
A
We
what
was
this
software
and
if
you
want
to
read
more
about
this,
you
can
go
to
the
page
archiveprogram.github.com.
We
also
listed
some
top
projects.
So,
let's
take
a
look
here:
real,
quick.
We
got
wordpress
neat,
we
got
node
bitcoin.
We
got
to
rebuild
the
economy,
ooh
linux,
that's
a
good
one.
I
think
linux.
By
the
way,
I
think
it
runs
on
three
billion
devices
now
so
thanks,
linus
and
team.
I
think
you
know
this.
A
One
to
preserve
for
the
future,
so
yeah
it's
got
a
million
commits.
That's
that's
one.
That's
gonna
be
a
good
one
to
rebuild,
with
cool,
so
check
that
out
and
kudos
to
the
people
that
had
their
source
code
making
into
that
program.
It's
actually
been
now
deposited
into
that
into
that
vault,
and
I
hope
that
we
never
need
to
use
it.
But
with
that
comment
passing
by
you
know
it
just
got
me
thinking.
You
know
we
gotta
make
sure
that
we
keep
our
space
program
very
funded,
okay,
so
now
jumping
into
dependencies.
A
I
want
to
sort
of
start
out
with
a
blog
post
that
was
written
for
an
acquisition
that
we
made
for
a
company
called
dependabot
which
we'll
get
into
in
just
a
little
bit,
but
a
lot
of
people
that
I
talk
to
are
not
aware
of
sort
of
how
many
dependencies
they
even
have
and
that's
something
I
hope
that
we
can
educate
you
with.
You
know
as
a
result
of
this
stream.
A
So
most
people
are
aware
that
they
have
their
sort
of
direct
dependencies,
the
packages
that
their
application
is
referencing
and
you're
like
okay,
I
know
about
those,
but
if
we
really
kind
of
look
further
into
it,
package
right
is
just
software
itself,
and
software
relies
on
other
software
right
like
we
don't
want
to
rebuild
everything
every
single
time
that
we
write
a
piece
of
code.
We
really
want
to
leverage
what's
been
written
already.
A
I
heard
a
statistic
recently
that
something
like
99
of
all
software
projects
now
have
some
sort
of
open
source.
So
this
is
not
even
an
option
anymore.
For
those
of
you
that
are
full-time
developers,
we
can
always
just
work
on
whatever
we
want
to
work
on
right.
Our
our
time
is
allocated
through
work
items
and
if
we
try
to
build,
you
know
commits
our
boss
that
we
want
to
write
our
own
json,
deserializer
they'll,
probably
say
no
like
just
pull
it
down
and
use
the
one
that
exists
and
that's
known,
embedded
and
performant.
A
So
anyways
our
dependencies
also
have
dependencies,
and
then
this
is
sort
of
a
bigger
problem
for
certain
environments
like
javascript,
so
very
quickly.
We
start
to
see
how
many
dependencies
that
we're
referencing
and
then,
if
any
of
these
dependencies,
have
a
security
vulnerability,
for
example,
this
ends
up
in
our
enterprise
software,
which
is
bad.
We
don't
want
this
to
be
exploited.
We
want
to
consume
open
source
and
get
our
jobs
done,
but
we
want
to
do
this
in
a
responsible
way.
We
want
to
be
educated
about
what
we're
consuming
and
how
much
of
it.
A
We
also
want
to
be
aware,
too,
of
the
license
types
that
are
sort
of
combined
with
these
packages.
So
that
way
you
know
for
the
specific
vertical
that
we
happen
to
be
operating
in.
We
want
to
be
aware,
you
know
if
there's
a
license
type
that
we
consider
risky,
we
might
want
to
migrate
away
from
that
package
and
go
to
a
different
license
type
that
has
similar
functionality
so
anyways.
I
just
thought
that
was
a
cool
chart,
because
people
are
like.
A
Oh
okay,
I
only
have
two
dependencies
and
then
we
start
looking
further
into
it
and
recursively
it's
kind
of
dependencies
all
the
way
down.
Okay,
so
jumping
into
kind
of
a
demo.
Here
and
again,
I
hope
everybody
learns
something
about
sort
of
the
dependencies
that
they're
consuming.
This
is
just
my
github
page
and
I'm
going
to
jump
into
the
fibonacci.
A
Everybody
remembers
this
from
the
coding
interview,
the
fibonacci
sequence,
by
the
way,
real
quick.
What
do
people
think
about
the
new
redesign
of
the
repository
page
and
github
in
general?
You
know
things
look
different
today
than
they
did.
You
know
even
a
few
months
ago.
Are
people
digging
this?
I
think
it's
cool.
I
like
the
way
out-
and
I
I
I've
been
digging.
It-
would
love
to
hear
your
feedback
about
that.
B
B
A
B
A
So
what
I'm
showing
you
here
is
that
I
want
to
get
into
the
dependency
graph
and
the
dependency
graph
is
going
to
basically
read
the
manifest
file
of
our
supported
package
types
for
repository
and
give
us
information
about
our
dependencies
that
this
repositories
is
using.
So
by
the
way,
if
you
don't
see
this,
this
can
be
enabled
by
going
into
settings
and
you
can
go
into
security
and
analysis.
A
A
We
can
also
configure
this
to
to
enable
this
for
all
new
private
repositories.
So
if
you
want
to
give
sort
of
blanket
consent
that
we
can
read
only
your
manifest
files
across
all
your
repositories,
we
can
enable
this
by
defaults
and
I'll
show
you
in
a
minute
that
information
will
be
aggregated
into
dependency,
insights,
sort
of
unified
dashboard,
where
you
can
kind
of
see
holistically
across
all
your
repositories,
information
about
what
open
source
you're
using
what
packages
you're
using
and
what
license
types
as
well.
A
Most
people
are
familiar
that
the
top
level
within
any
github
sort
of
account
is
the
organization,
but
we
actually
have
a
level
higher
called
the
the
enterprise
account
which
allows
you
to
apply
policy
and
security
settings
over
many
different
organizations.
This
won't
apply
to
everybody,
but
in
case
you
happen
to
be
sort
of
an
enterprise
admin.
A
Okay,
so
jumping
back
into
the
fibonacci
repository
that
we
were
just
in
I'm
going
to
go
to
insights
and
the
dependency
graph.
So,
as
I
mentioned
before,
this
is
going
to
give
us
visibility
into
what
dependencies
that
we're
referencing
and
what
we're
doing
is
that
we're
reading
a
manifest
file
and
then
we're
displaying
it
here
so
immediately.
We
start
to
see
some
information
that
there's
security
vulnerabilities
within
our
dependencies.
A
So
this
is
something
that
github
has
made
tremendous
investment
in
and
we
really
want
to
again.
We
want
everybody
to
develop
it
in
a
secure
way
or
secure
as
possible,
and
we
have
very
effective
approaches
to
help
inform
you
of
these
security
vulnerabilities,
but
we're
not
just
trying
to
give
you
more
work
by
letting
you
know
about
this.
A
We
have
an
approach
and
automated
security
fixes,
which
we'll
get
into
a
little
bit
later
about
how
you
can
fix
this
very
easily
and
we've
seen
this
be
enormously
successful
because
we
don't
require
you
always
to
you
know,
open
up
a
pull
request.
We
can
automatically
do
this
and
we'll
get
into
that
a
little
bit
later.
But
if
I
click
into
one
of
these,
for
example-
oh
corey
did
we
have
a
question.
B
Yeah
actually
well,
we
have
an
interesting
comment
about
getting
a
dependable
alert
about
lowdash
and
I
see
actually
in
this
repository,
we
have
dependency
alerts
on
lowdash,
along
with
a
couple
other
dependencies,
so
I'd
say
to
if
we
walk
through
this
example,
I
think
that
if
we're
following
along
live,
we
might
be
able
to
mimic
exactly
what
you're
doing
here
within
dependency
alerts
and
their
own
repositories.
So
I
just
wanted
to
make
that
tie
between
a
comment
here
in
the
chat.
A
Yeah
for
sure,
so
we
can
actually
jump
right
into
that
so
corey.
If
you
want
to
share
the
link
to
my
vs
code,
one
I'm
also
happy
to
we
can
follow
along
with
that,
so
yeah,
just
like
cory
was
saying
we're
going
to
have
the
pan
about
alerts.
So
what
these
are
is
that
they're,
making
us
aware
of
vulnerabilities
that
are
weighing
weight
in
within
our
open
source
dependencies
as
we
are
mentioning,
and
you
can
access
this
from
different
places,
so
we
can
get
it
from
the
dependency
graph.
A
We're
going
to
have
a
series
of
depend
about
alerts
that
we
might
want
to
address
here
again.
What
we're
seeing
here
was
our
open
source
dependencies
and
we
can
expand
them.
Something
I
just
want
to
add.
Just
very
quickly
is
that
dependence,
our
dependencies,
have
their
own
series
of
dependencies,
and
you
can
quickly
see
that
and
see.
A
What
we'll
do
is
that
will
make
you
aware
of
vulnerabilities
that
exists
within
new
dependencies
and
let's
just
say
that
we
want
to
sort
by
severity.
So
severity
is
an
indication
that
you
know
critical
being
the
highest
that
they're
something
that's
laying
weight
within
this.
That
can
be
exploited
that
we
really
don't
want
to
end
up
in
our
software.
A
So
it's
something
that
we
want
to
address
sooner
than
later,
so,
for
example,
using
low
dash
as
an
example,
if
I
click
into
it,
we're
going
to
give
you
a
lot
of
information
about
what's
going
on
here
now.
What
I
did
here
by
the
way
is
I
just
forked
bs
code,
which
is
fully
open
source
and
I
purposefully
didn't
update
it.
So
I've
been
a
bad
developer.
I've
just
been
letting
it
sit
here
and
it's
been
accumulating
these
security
vulnerability
alerts
so
immediately
we
start
to
see
that
we
have
an
open
security
alert
here.
A
We
see
when
it
was
opened,
and
then
we
start
to
see
that
we
have
some
information
about
remediation,
about
which
version
of
lodash
fixes
this
vulnerability.
But
furthermore,
we
also
have
information
about
the
cve
number.
So,
for
those
of
you
not
aware
already,
we
recently
became
a
cve
numbering
authority,
so
we
now
empower
open
source
maintainers
on
our
platform
to
file
cves
directly
from
github.
So
it's
our
responsibility
being
the
home
of
open
source
and
the
world's
largest
development
community.
We
really
want
to
empower
open
source
maintainers
to
be
able
to
raise
the
red
flag.
A
If
there's
vulnerabilities
for
the
electrical
engineers
on
the
line,
I
like
to
say
that
we're
very
close
to
the
signal,
meaning
that
we
have
the
open
source
source
code
on
our
platform
and
we
have
the
maintainers
and
the
contributors
and
we've
been
adding
features
to
our
platform
to
help
secure
what
we're
calling
the
open
source
supply
chain.
So
the
way
in
which
we
can
do
that
is
by
empowering
maintainers
to
raise
these
cpes
from
our
platform.
A
There's
a
couple
other
features
I
want
to
mention
too
really
quickly.
One
of
them
is
that
we
also
have
security
policy
that
you
can
add
to
your
repository.
This
will
inform
people
that
want
to
make
you
aware
of
vulnerability
how
in
which
they
should
do
that.
So
not
everybody's
a
security
researcher
and
if
they
find
a
vulnerability,
they
just
might
fire
up
a
public
issue
and
create
a
zero-day
situation
which
we
don't
want.
A
The
security
advisory
allows
you
to
advise
the
people
that
are
coming
to
your
repository,
how
they
should
file
a
vulnerability
like
you
might
want
this
to
be
done
privately.
So
that
way,
you
can
start
to
collaborate
with
other
maintainers
without
you
know,
releasing
the
vulnerability
before
you
have
the
fix.
There's
another
feature
too.
I
want
to
mention
really
quickly.
A
We
also
allow
open
source
repositories
that
are
public
to
create
a
private
fork,
so
that
way
they
can
collaborate
with
other
maintainers
and
actually
come
out
with
the
fix
at
the
same
time,
they're
coming
out
with
the
alert.
So
that
way,
it's
not
something
that
people
can
exploit
before
we
have
the
fix,
ready,
okay,
cool,
so
just
jumping
into
one
of
these
cves,
for
example,
I'm
going
to
click
on
this
critical
severity,
one
we're
going
to
give
you
information
about
the
affected
version.
We're
going
to
give
you
more
information
about
what's
going
on
here.
A
In
this
case,
the
affected
versions
are
vulnerable
to
prototype
pollution.
My
understanding
is
that
that
can
lead
to
arbitrary
code
execution,
definitely
something
that
we
want
to
address,
and
furthermore,
what's
really
neat
is
that
github
will
actually
give
you
if
we
have
it
the
pull
requests
that
actually
fixes
this
vulnerability.
A
So
again,
you
can
kind
of
explore
with
infinite
depth
here,
in
this
case
we're
actually
giving
you
the
pr
that
actually
fixes
this.
So
if
you
actually
wanted
to
dive
into
the
actual
lines
of
code
that
affix
this
vulnerability
or
read
the
comments
or
find
out
more
information,
we're
going
to
give
you
this
information
and
what's
really
cool
about
this-
is
that
we
haven't
navigated
away
from
github
we're
doing
this
all
sort
of
end
to
end
right
from
within
our
platform,
so
very
powerful.
A
You
might
not
always
have
to
go
into
this
infinite
depth,
but
it's
there
if
you
need
it
and
you
can
share
it
with
your
security
team.
One
more
thing
too.
As
I
mentioned,
we
can
raise
vulnerabilities
on
our
platform.
We
launched
something
called
the
advisory
database,
so
if
you
want
to
find
out
more
information
about
cves
raised
in
our
platform,
we're
going
to
give
you
a
highly
curated
set
of
information
about
what's
going
on
and
what
the
affected
environments
are.
A
So,
furthermore,
our
vulnerability
data,
just
in
case
it
doesn't
come
from
github.
You
know
that's
one
source
of
data
and
we'll
share
that
out
as
well.
We
also
partner
with
leading
authorities
and
vulnerability
data
like
mitra
and
white
source
as
well.
So
we
supplement
our
data
with
that.
So
it's
not
just
like
a
single
source
and,
as
I
mentioned
before,
we
also
share
out
our
vulnerability
data
too.
We
have
a
graphql
api
and
other
folks
can
parse
this
as
well.
A
We
don't
just
record
the
data,
so
okay
cool,
but
at
the
end
of
the
day,
what
we
really
want
to
do
is
we
want
to
fix
this
and
we
actually
have
the
easy
job
being
software
developers
to
some
degree
or
software
consumers
in
this
case
open
source
consumers
that
we
don't
have
to
fix
this.
We
just
have
to
update
our
package,
so
you
know
the
open
source.
A
Maintainer
is
actually
doing
a
tough
job,
they're
actually
going
ahead
and
fixing
it
or
for
those
of
you
that
are
opening
up
a
pr
of
the
you
know
of
the
repo
is
open
source.
You
know
you
have
the
tough
job
you're
actually
going
ahead
and
fixing
this,
but
we
as
software
developers
we
just
have
to
update,
but
honestly,
that's
a
lot
to
ask
for
very
busy
we're,
not
always
given
time
to
do
this
stuff,
we're
trying
to
get
features
at
the
door.
Our
boss
is
yelling
at
us.
A
So
what
we
found
in
practice
is
that,
even
when
we
told
people
that
they
had
a
critical
severity
vulnerability,
they
still
wouldn't
patch
it
like.
Even
if
we
said
it
was
really
bad.
It
was
something
like
three
quarters
of
the
people
that
we
would
make
aware
of
this
after
30
days
still
would
not
even
update
the
package
version,
because
it's
it's
work
that
you
have
to
do
and
work
that
you
have
to
do
can
be.
You
know
you
can
choose
to
not
do
it,
so
we
still
consider
this
our
problem.
A
So
what
we
did
is
we
made
an
acquisition
github
made
an
acquisition
for
a
company
called
dependabot
and
we've
integrated
this
into
our
platform,
and
now
what
we
do
is
we
automatically
open
up
a
pull
request
that
bumps
the
package
version
to
the
version
that
fixes
this
vulnerability
automatically
for
you.
So
that
way,
your
engineers
can
come
in
the
morning
and
say
shoot.
We
have
a
critical
severity
vulnerability,
but
it
looks
like
the
pentabot
has
opened
up
a
pr
for
it
and
we
can
quickly
look
at
the
files,
change
and
say:
okay,
cool.
A
We
just
went
from
11
to
19
and
we
changed.
The
hash
looks
good
to
me.
Another
thing
that
we
give
you
too,
is
a
compatibility
score.
We
measure
the
success
of
other
open
source
repositories
that
have
merged
this
pr.
We
measure
the
success
of
them
building
afterwards.
So
you
know
what
is
it
friday
afternoon
for
some
people
with
a
90
plus
percent
compatibility
score?
You
might
feel
more
comfortable
doing
this
on
a
friday
afternoon,
but
if
this
is
like
a
one
percent
compatibility
score,
you
know
you
might
want
to
save
that
one.
A
You
know
and
not
merge
it
and
then
go
home
for
the
weekend.
You
know
because
it
might
break
something
so
anyways.
This
makes
it
very
easy
for
you
to
come
in
the
morning
and
say:
okay,
we
have
these
pr's
that
are
open,
we're
bumping
the
package
version
and
it's
a
lot
easier
to
hit
the
green
button.
Merge
pull
requests
than
it
is
for
you
to
figure
out.
A
You
know
which
version
fixes
this
vulnerability
and
fire
up
a
pr
and
start
to
do
some
research,
not
everybody
in
your
team
needs
to
be
a
security
researcher.
We
want
to
offload
some
of
that
thinking
for
you.
So
that
way
you
can
just
get
on
with
you
know
what
your
normal
job
is,
which
is
creating
features
and
fixing
your
software's
bugs
and
whatnot.
A
So
we're
happy
to
take
any
questions
that
you
have
about
this.
We
hear
really
really
good
feedback
corey
and
I
work
with
some
of
our
largest
customers,
and
this
is
something
that's
sort
of
integral
to
their
development
process
and
we
have
millions
and
millions
and
millions
of
those
of
these
prs
that
are
have
been
opened
by
dependable
being
merged,
and
you
know
downstream.
As
a
software
consumer,
I
mean
I
use
software
every
day,
very
happy
that
this
made
it
in
because
this
helps
make
software
more
secure
in
general.
A
A
You
can
go
into
settings
either
at
the
user
level
at
the
repository
level,
at
the
organizational
level
at
the
github
enterprise
account
level
and
enable
or
disable
these
depending
on
what
you
want
to
do
there
and
that's
for
both
dependable
alerts
and
depend
about
security
updates
as
well
one
more
bit
about
security
or
about
depend
about
as
well.
You
can
also
look
at
our
documentation
to
how
to
configure
this.
A
We
can
also
enable
this
for
grabbing
the
most
recent
or
most
updated
stable
version
of
that
package,
regardless
of
security
updates,
so
depend
about
automated
security
fixes
will
update
to
the
minimum
version
that
fixes
that
vulnerability.
This
can
also
be
configured
to
just
grab
the
latest
version,
regardless.
If
it
has
a
vulnerability
or
not,
so
you
get
to
decide
on
what
you
want
to
do.
There.
B
B
A
B
I
think
on
this
point
too,
but
this
has
really
been
helpful
for
me
in
a
past
life,
when
I
was
a
api
engineer,
I
worked
a
lot
within
javascript
and
doing
no
development
running
a
lot
of
middleware
and
then
having
a
lot
of
dependencies
and
to
your
point.
Updating
one
dependency
can
break
another
dependency
and
it
can
break
another
dependency,
and
I
think
developers
kind
of
worse
scenario
is
that
we're
trying
to
do
this
in
the
right
light.
We're
trying
to
be
secure
right.
B
B
Maybe
a
an
actual
code
feature
functionality
in
a
repository
because
we
ended
up
bumping
a
dependency
because
of
that
misunderstanding
or
lack
of
understanding
of
how
many
dependencies
we're
actually
consuming.
So
I
know
I've
used
that
compatibility
score
a
ton
with
some
a
little.
I
guess
insurance
policy
and
confidence
to
know
that
if
I'm
going
to
merge
this,
I'm
not
going
to
have
another
breaking
change
somewhere
else.
In
my
code,
it's
great
for
those
interpreted
languages
and
with
this
being
a
compiled,
or
should
I
say,
with
this
being
a
real
pull
request.
B
A
Yeah
thanks
for
that
cory
and
yeah
as
we're
learning
too
kind
of,
as
we
do
like
retro
perspectives
on
what
happens
with
data
breaches,
and
things
like
this.
A
lot
of
these
could
have
been
simply
mitigated
by
updating
the
package.
So
it's
not
always
like
a
revelation
that
you
know
it's
like
this
amazing
complex
thing.
Sometimes
we
just
find
out
that
you
just
need
to
update
the
package
in
order
for
to
avoid
that,
something
that
can
be
exploited
or
something
like
that.
So.
B
A
And
the
more
that
we
can
empower
developers
because
yeah
security
researchers
in
general,
if
you're
lucky
enough
to
have
one
of
those
at
your
company,
they
don't
scale
very
well
they're,
very
expensive
right.
It's
very,
very
esoteric
knowledge,
so
the
more
that
we
can
help
educate
you
as
a
developer
about
you
know.
A
What's
going
on
within
your
dependencies,
the
more
you
can
focus
on
you
know,
building
features
and
getting
your
job
done
so
amazing
thing
and
we
we'd
love
to
hear
also
two
feedback
about.
If
you
have
used
this,
you
know
what
you
think
about
it
so
jumping
back
into
that
fibonacci
example.
What
I
want
to
do
is
I
just
want
to
make
sure
that
we
capture
a
thought
or
sort
of
the
dependency
graph.
So,
as
I
was
showing
you,
we
want
to
be
informed
about
what
our
dependencies
are,
what
their
dependencies
are.
A
A
lot
of
the
ux
here
is
by
the
way,
is
going
to
link
back
to
our
security
tab
and
if
you
haven't
been
to
github
in
quite
some
time,
you're
going
to
see
new
tabs
at
the
top.
Like
you
know,
actions
is
a
new
tab.
That's
our
integrated,
ci
cd
environment
so
definitely
check
that
out
as
well,
and
we
have
security
as
well,
so
we're
linking
into
the
security
area
from
our
insights
tab
and
once
we
have
this
information
by
the
way.
A
So
this
is
at
the
repository
level,
and
this
is
going
to
inform
us
about
what
our
dependencies
are
and
also
to,
if
anything
is
dependent
on
the
software.
We
can
also
find
this
out
like
just,
for
example,
if
you
go
to
like
ruby,
for
example
like
ruby
rake
and
you
go
to
their
insights
tab
and
we
go
to
their
dependency
graph,
so
yeah
we
see
that
it
has
direct
dependencies
and
then
we
can
go
to
dependence.
So
what's
relying
on
ruby
rake?
A
What's
really
neat
about
this
is
that
we
can
see
some
pretty
impressive
numbers
here.
So
1.7
million
repositories
are
dependent
on
rake,
and
you
know
almost
81
000
packages
are
dependent
on
it,
so
you
can
kind
of
see
the
impact
and
sort
of
the
how
much
this
is
used
across
the
open
source
community.
It
gives
us
an
understanding
of
you
know
how
important
this
is.
A
A
So
just
for
example,
we
see
here
that
we
have
a
package
mini
2,
it
has
1700
dependents
and
we
can
see
information
about
what
environment
and
ecosystem
it
is
and
if
I
click
in,
we
can
find
out
more
information
again.
This
might
be
a
big
surprise
to
you
and
I'd
be
curious
to
see
you
know
for
those
of
you
in
the
stream.
A
A
So
if
you
click
into
it,
what
we're
doing
is
that
we're
scraping
the
readme
file
from
this
repository.
You
can
find
out
more
information.
So
if
you
want
to
read
through
and
find
out
what
this
is,
how
it's
used
what's
going
on
documentation,
but
more
importantly
over
here,
we
can
see
here
that
we
have
a
version.
That's
from
2018.
A
We
can
see
the
version
number
that
is
being
used
currently
across
all
the
repositories.
Here
we
can
see
the
license
type
and
we
have
some
information.
That's
sort
of
organization
specific
here,
so
here
we
can
see
that
we
have
1704
dependents.
Using
this
version.
What's
interesting
is
that
we
also
have
almost
500
pens
using
an
older
version.
A
We
might
be
aware
we
might
want
to
be
made
aware
of
if
someone
is
using
or
a
repository
that
we're
a
part
of
is
using
an
older
new
version
again,
just
like
we
saw
in
the
dependency
graph,
we
can
also
dive
into
its
dependencies,
and
then
we
can
start
to
expand
out
and
start
to
go
down
that
rabbit
hole
there.
We
can
also
find
out
what
it's
dependent
on
or
what
depends
on
it,
and
then
we
can
see
contributors
as
well.
A
So
here
we
can
see
that
we
can
sort
by
that
fact,
and
if
we
click
into
this,
for
example,
we
can
see
here
that
we
have,
you
know
active
security
advisories
for
this
package.
We
can
see
here
that
we
have,
you
know,
a
repositories
that
are
using
this
and
then
we
can
click
into
the
security
tab
and
find
out
more
information
about
the
open
cves
in
this
case
we're
using
a
really
old
version,
it's
from
2017.
So
it's
you
know
about
three
years
old
and
we
have
46
open
security
advisories.
A
Another
thing
I
wanted
to
say
too
about
the
dependency
insights
dashboard
here,
so
you
might
again,
as
I
mentioned
before,
you
might
consider
certain
license
types
risky.
Now,
it's
not
github
is
not
going
to
tell
you
what
we
consider
risky,
because
it's
going
to
vary
depending
what
vertical
that
you're
in
you
know,
if
you're
in
healthcare
or
if
you're,
banking
or
whatever
it
may
be.
But
what
this
will
do
is
that
this
will
inform
you
about
what
license
types
that
are
used
across
the
dependencies
that
you're
referencing.
A
So
if
there
you
know,
was
an
advisory
from
your
policy
team
or
from
your
lawyers.
That's
saying:
okay,
we
shouldn't
be
using
this
license
type
anymore,
because
an
underlying
sort
of
term
within
it
is
sort
of
not
aligning
with
you
know
the
enterprise
that
we
happen
to
be
in.
You
know
you
can
fire
up
a
github
issue
and
assign
somebody
to
take
a
look
at
that
and
maybe
migrate
away
from
that
from
that
package
type.
A
Okay,
cool
yeah,
we're
happy
to
take
any
questions,
we're
about
37
minutes
in
and
this
is
what
I
wanted
to
cover
for
today.
I
really
hope
that
this
was
informative
and
that
you're
learning
a
few
things
I'll
hang
out
for
a
minute
or
two
more
and
we'll
take
some
questions.
If
we
have
any
again,
we
have
william
on
from
our
product
team
as
well.
So
if
you
want
to
ask
anything
directly
from
the
github
product
team,
we're
happy
to
take
those.
B
B
You
will
as
well,
so
you
can
both
see
your
maybe
most
dependent
package,
but
then
on
the
security
side
of
this.
Maybe
what
advisories
you
want
to
take
care
of.
We
won't
want
to
pick
on
anybody
on
the
stream.
If
you
have
some
security
issues,
you
need
to
fix
in
your
code,
but
it
would
be
fun
to
see
maybe
what
languages
are
used.
B
It
looks
like
in
our
dependency
insights
here
we're
using
a
lot
of
javascript
we're
using
a
lot
of
npm
as
an
ecosystem,
but
maybe
some
folks
are
using
other
ecosystems
like
more
java
code,
or
maybe
newgetpackages.net
so
would
love
to
know,
maybe
as
well
a
breakdown
of
what
type
of
languages
folks
are
programming
in
today,
because
github's
also
looking
for
both
that
feedback,
but
then
also
that
kind
of
community
response
of
what
the
most
trending
languages
are
in
the
kind
of
dev
space
and
then
as
well.
Maybe
why
you're
using
that
language?
B
Is
there
a
lot
of
open
source
packages
for
javascript
that
make
it
easier
for
you
to
build
your
web
applications
or
maybe
there's
trending
topics
around
net
new,
get
that
we
want
to
focus
on
as
well
so
we'd
love
to
know?
I
guess
with
the
folks
that
are
in
the
stream
what
your
dependency
insights
look
like
what
languages
you're
using?
Maybe
what
dependents
are
most
dependent
in
your
code.
A
Yeah
some
good
points,
corey
yeah.
What
we
typically
see
is
that
people
like
way
underestimate
the
amount
of
dependencies
they
actually
have
and
then
they're
not
aware
of
those
indirect
dependencies.
So
I
really
hope
that
this
is
sort
of
enlightening
and
for
those
folks
that
are
now
enabling
the
depend
about
security.
Automated
fixes,
that's
real
cool
and
really
happy
that
you
did
that
and
definitely
pay
attention
to
those
prs
and
software
is
going
to
get
more
secure
as
a
result
of
you
doing
that.
So
thank
you.
Yeah.
B
We
we
did
build
some
insurance
as
well,
in
that
in
case,
you
don't
pay
attention
to
those
pull
requests.
They'll
continually
get
added
as
new
commits
and
I've
seen
that
in
my
own,
my
own
repositories,
I'll,
maybe
not
merge
a
dependent
pr
right
off
the
bat,
but
then
depend
about
we'll
keep
scanning
and
keep
adding
more
and
more
pull
requests.
B
We're
really
trying
to
do
is
focus
that
information
back
from
the
maintainers
and
the
work
that
they're
doing
and
show
that
they're
continually
investing
in
their
projects,
as
you
should
be
continually
investing
in
yours,
kind
of
bridging
that
gap
between
private
development
and
open
source
development,
because
more
and
more
folks
are,
of
course,
consuming
open
source,
but
we
want
to
make
sure
they're
doing
it
securely
too.
That's
kind
of
what
this
feature
is
really
all
about.
A
Yeah,
that's
an
excellent
point.
Corey.
So
just
reiterate
that
we'll
continue
to
open
up
these
pull
requests
and
update
them
as
the
package
accumulates
more
vulnerabilities,
so
it's
not
just
static
and
you
know:
gonna
sit
there
forever.
It's
gonna
be
updated
over
time.
All
right
awesome!
So
again,
thank
you
all
for
joining
the
stream.
I
hope
you
learned
something
today
and
again.
If
you
want
to
see
more
topics
in
the
future,
we're
gonna
continue
to
do
these
every
friday.
So
definitely
join
us
next
friday
too,
as
well.