►
Description
Show Notes
From software composition reports, we know that most applications rely on dozens or even hundreds of open source dependencies. Sometimes, adding a single library to your manifest file can result in bringing in a massive dependency tree. How can we make sure that we stay on top of any known vulnerabilities, and update our dependency versions as needed?
In this video, Maya Kaczorowski and Sasha Rosenbaum discuss how Dependabot works behind the scenes to help you identify and remediate known vulnerabilities, and show us a demo of the feature.
5:13 - demo: leveraging Dependabot
12:01 - demo continued
Dependabot alerts: https://github.co/security-alerts
Dependabot security updates: https://github.co/security-updates
Maya Kaczorowski:
GitHub - https://github.com/mayakacz
Twitter - https://twitter.com/MayaKaczorowski
Sasha Rosenbaum:
GitHub - https://github.com/DivineOps
Twitter - https://twitter.com/DivineOps
As always, feel free to leave us a comment below and don't forget to subscribe: http://bit.ly/subgithub
Thanks!
Connect with us.
Facebook: http://fb.com/github
Twitter: http://twitter.com/github
LinkedIn: http://linkedin.com/company/github
About GitHub
GitHub is the best place to share code with friends, co-workers, classmates, and complete strangers. Millions of people use GitHub to build amazing things together. For more info, go to http://github.com
A
A
B
So
dependabot
is
basically
your
friendly
update
bot
for
your
for
your
environment
that
lets.
You
know
when
you
have
a
security
vulnerability
in
one
of
your
dependencies
and
helps
you
update
that
dependency
and
dependable
does
a
couple
of
different
things.
It
alerts
you
when
you
have
a
vulnerability
in
a
dependency.
B
A
Okay,
this
all
sounds
really
useful.
So
actually,
you
have
been
working
primarily
on
software
supply
chain
security
features.
Since
you
came
over
to
github-
and
I
think
this
work
is
really
really
important,
because
we
know
from
software
composition
reports
that
over
90
of
all
applications
in
the
world
use
open
source
software,
and
this
is
a
good
thing
because,
like
no
one
needs
to
re-implement
simple
math
in
their
application
over
and
over
again,
but
it
also
means
that
we're
all
having
open
source
dependencies.
So
how
does
it
impact
project
security,
yeah.
B
That's
that's
completely
right.
I
mean
from
the
latest
state
of
the
october
report.
We
know
that
anywhere
from
65
to
94
of
active
repos
on
github
rely
on
open
source
code
and
the
variability
there
is
coming
from
different
ecosystems
and
exactly
you're
saying
everyone
has
a
huge
dependency
on
open
source.
You
know
the
median
active
repo
might
only
have
a
handful
of
direct
dependencies,
but
it
has
many
hidden
indirect
dependencies
as
well,
with
javascript
being
the
clear
winner
with
a
median
683
transitive
dependencies
now
wow.
We
want
people
to
keep
using
open
source
right.
B
So
as
a
software
developer,
what
you
really
need
to
know
is
know
what's
in
your
environment,
so
you
know
know
what
dependencies
you
use
and
then
manage
your
dependencies,
so
knowing
about
vulnerabilities
in
those
dependencies,
knowing
the
latest
versions
of
those
and
being
able
to
patch
them.
So
when
there
is
a
new
vulnerability,
you
can
quickly
discover
it
and
react
to
it
by
patching
your
environment.
A
B
A
B
Yeah,
we
will
always
try
to
generate
a
pr
and
send
it
to
you,
but
there's
a
few
cases
where
that's
not
possible
and
there's,
hopefully
helpful
error
messages
to
tell
you
what's
going
on.
Some
of
the
common
cases
include,
for
example,
invalid
graphs.
So
what
I
mean
by
that
is,
you
might
have
dependency
a
depending
on
dependency
versions.
You
know
one
or
two
and
dependency
b
needs
versions,
two
or
more,
and
then,
if
you
have
to
upgrade
to
version
three,
for
example,
because
of
vulnerability,
then
a
will
no
longer
work.
B
A
B
To
so
let
me
just
share
my
screen,
so
we
are
looking
at
my
repository
here.
I
have
a
manifest
file
in
my
repository
and
I
have
a
handful
of
dependencies
that
are
that
are
explained
in
that
manifest
file.
So
far,
so
good,
not
a
whole
lot
going
on.
So
let
me
actually
go
enable
these
security
features.
First,
so
I'll
go
over
to
my
settings.
B
B
So
let's
enable
all
three
of
those
features,
and
now
we
have
dependabot
dependency
graph,
dependable
alerts,
independent
security
updates
enabled
so
I'll
go
over
to
my
security
tab
in
my
security
tab,
you'll
see,
there's
already
depend
about
alerts
sent
to
me,
so
it
was
very,
very
fast
and
it
automatically
worked
in
that
environment
and
I
have
four
alerts
and
they
tell
me
you
know
what
severity
the
alerts
are.
It
tells
me
what
manifest
file
is
affecting
and
what
the
issue
is.
B
So
I
click
through
that
and
I
can
get
some
details
on
what
that
vulnerability
is.
So
I
have
an
issue
in
jackson:
data
bind,
I
should
upgrade
to
version
2.9.10.4
or
later,
and
actually
what
I
saw
was
that
there
was
you
know,
critical
severity,
but
there's
lots
of
different
security
issues
in
this
in
this
given
alert.
So
we've
combined
a
lot
of
information
about
this
one
dependency
into
all
the
the
vulnerabilities
that
you're
affected
by
for
that
one
dependency
today,.
A
B
Yeah,
all
of
these
will
have
remediation
information
kind
of
right
at
the
top.
That
tells
you
what
you
need
to
do
to
fix
that
in
your
environment,
and
so
you
know
we
alert
open
the
alert
22
seconds
ago
and
dependibots
trying
to
generate
for
us
a
security
update.
So
that's
a
pull
request
actually
to
address
the
issue
that
we
have
in
our
environment.
B
Let
me
just
go
back
and
see
if
we
have
a
security,
a
pull
request
already
generated,
in
fact
the
one
that
I
was
just
looking
at.
We
do
and
I'll
click
on
that
pull
request
and
that
pull
request
addresses
a
security
vulnerability.
So
you
have
that
information
right
there.
If
you
have
the
permissions
to
see
that-
and
it
tells
you
what
it's
working
on-
it's
upgrading
jackson,
databind
from
2.8.11.0
to
2.9.10.5,
I
can
go
over
and
see.
B
B
B
While
we
were
chatting
and
if
I
go
over
to
security,
I
should
now
see
that
I
still
have
a
couple
of
alerts,
open,
yep
and
in
fact
my
other
dependency.
Sorry,
my
other
vulnerabilities
and
dependencies
now
all
have
pull
requests
generate
as
well.
So
dependibot
is
working
hard
for
me
today
and
I
have
lots
of
work
to
go.
Merge
these
in
as
well.
A
B
B
A
B
Yeah
dependabot
gets
information
about
vulnerabilities
from
github's
advisory
database,
so
that's
information
that
maintainers
have
submitted
to
github
about
security
issues
and
their
own
repositories,
as
well
as
information
that
we
import
to
github
from
other
other
registries.
Other
vulnerability
information,
so
that
we
can
tell
you
what's
going
on
in
in
your
environment,
dependable,
will
then
send
you
an
alert
and
a
pr
and
all
that
kind
of
information
in
basically
two
cases,
if
you
think
about
it
that
way.
B
The
first
case
is
where
you
have
an
existing
dependency
that
has
a
new
vulnerability,
so
you're
newly
affected
by
something
that's
happened,
we'll
let
you
know.
The
second
case
is
where
you
have
in
a
new
new
dependency
that
you're
introducing
where
you're
introducing
a
dependency
that
already
has
a
vulnerability
in
it.
A
B
A
Sounds
good
so
we're
obviously
going
to
add
some
documentation
links
to
this,
and
you
know
you
can
all
get
started,
reviewing
the
blogs
and
the
docs
and
obviously
taking
advantage
of
this
amazing
feature.
So
thank
you,
maya
for
working
on
these
features
and
helping
us
make
the
web
more
secure,
and-
and
also
thank
you
for
being
here
with
me
today.
This
has
been
get
up
check
out
and
please
hit
subscribe
for
more
interesting
videos
about
github
features.
Thank
you
and
bye.