GitHub's security features help you keep track of your projects' dependencies and built artifacts.
GitHub helps you secure your supply chain, from understanding the dependencies in your environment, to knowing about vulnerabilities in those dependencies, and patching them.
About open source license compliance
Define and enforce license policy for dependencies in your repositories with open source license compliance.
Best practices for maintaining dependencies
Guidance and recommendations for maintaining the dependencies you use, including GitHub's security products that can help.
You can use the dependency graph to identify all your project's dependencies. The dependency graph supports a range of popular package ecosystems.
How the dependency graph recognizes dependencies
The dependency graph automatically analyzes manifest files. You can submit data for dependencies that cannot be detected automatically.
Dependency review lets you catch insecure dependencies before you introduce them to your environment, and provides information on license, dependents, and age of dependencies.
Dependabot alerts help you find and fix vulnerable dependencies before they become security risks.
Dependabot malware alerts help you identify malware in your dependencies to protect your project and its users.
Use metrics to track and prioritize Dependabot alerts across your organization.
Dependabot can fix vulnerable dependencies for you by raising pull requests with security updates.
You can use Dependabot to keep the packages you use updated to the latest versions.
Understand the frequency and customization options of pull requests for version and security updates.
Multi-ecosystem updates combine dependency updates across multiple package ecosystems into a single pull request, reducing review overhead and simplifying your update workflow.
The dependabot.yml controls automated dependency updates in your repository.
Automatic Dependabot access to GitHub-hosted registries
Keep your private dependencies up to date reliably by granting Dependabot automatic access to GitHub Packages and Container registry, so you never need to create or rotate credentials for these registries.
Control how Dependabot handles security alerts, including filtering, ignoring, snoozing, or triggering security updates.
Dependabot on GitHub Actions runners
GitHub automatically runs the jobs that generate Dependabot pull requests on GitHub Actions if you have GitHub Actions enabled for the repository. When Dependabot is enabled, these jobs will run by bypassing Actions policy checks and disablement at the repository or organization level.
GitHub logs every update job run by Dependabot, giving you visibility into version updates, security patches, and automated rebases across your dependencies.
Learn about immutable releases and how they can help you maintain the integrity of your software supply chain.
The linked artifacts page helps you audit and prioritize your organization's builds on GitHub, regardless of where the artifacts are stored.