Securing your dependencies

Keep your supply chain secure by understanding and updating dependencies.

Links

• Configuring Dependabot alerts

  Enable Dependabot alerts to be generated when a new vulnerable dependency is found in one of your repositories.

• Configuring Dependabot malware alerts

  Prevent malware attacks by identifying and remediating malicious dependencies.

• Protecting endpoints with GitHub package firewall

  Protect dependency installations on developer machines, AI agents, and CI runners with GitHub package firewall.

• Configuring Dependabot security updates

  You can use Dependabot security updates or manual pull requests to easily update vulnerable dependencies.

• Configuring Dependabot version updates

  You can configure your repository so that Dependabot automatically updates the packages you use.

• Managing innersource advisories

  Create, distribute, and withdraw enterprise-scoped advisories to alert your internal repositories to vulnerabilities and ship fixes automatically.

• Keeping your actions up to date with Dependabot

  You can use Dependabot to keep the actions you use updated to the latest versions.

• Configuring multi-ecosystem updates for Dependabot

  Reduce the number of Dependabot pull requests you receive by grouping updates across multiple ecosystems into a single, consolidated pull request.

• Enabling the dependency graph

  You can allow users to identify their projects' dependencies by enabling the dependency graph.

• Exploring the dependencies of a repository

  You can use the dependency graph to see the packages your project depends on and the repositories that depend on it. In addition, you can see any vulnerabilities detected in its dependencies.

• Configuring automatic dependency submission for your repository

  You can use automatic dependency submission to submit transitive dependency data in your repository. This enables you to analyze these transitive dependencies using the dependency graph.

• Using the dependency submission API

  You can use the dependency submission API to submit dependencies for projects, such as the dependencies resolved when a project is built or compiled.

• Verifying the integrity of a release

  You can avoid tampering and accidental changes by ensuring the releases you use have not been modified after publication.