You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: content/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/configure-version-updates.md
+8-8Lines changed: 8 additions & 8 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -47,12 +47,12 @@ You enable {% data variables.product.prodname_dependabot_version_updates %} by c
47
47
```
48
48
49
49
1. Add a `version`. This key is mandatory. The file must start with `version: 2`.
50
-
1. Optionally, if you have dependencies in a private registry, add a `registries` section containing authentication details. For more information, see [AUTOTITLE](/code-security/dependabot/working-with-dependabot/configuring-access-to-private-registries-for-dependabot).
51
-
1. Add an `updates` section, with an entry for each package manager you want {% data variables.product.prodname_dependabot %} to monitor. This key is mandatory. You use it to configure how {% data variables.product.prodname_dependabot %} updates the versions or your project's dependencies. Each entry configures the update settings for a particular package manager. For more information, see [AUTOTITLE](/code-security/concepts/supply-chain-security/about-the-dependabot-yml-file) and [AUTOTITLE](/code-security/dependabot/working-with-dependabot/dependabot-options-reference).
50
+
1. Optionally, if you have dependencies in a private registry, add a `registries` section containing authentication details. For more information, see [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configure-access-to-private-registries).
51
+
1. Add an `updates` section, with an entry for each package manager you want {% data variables.product.prodname_dependabot %} to monitor. This key is mandatory. You use it to configure how {% data variables.product.prodname_dependabot %} updates the versions or your project's dependencies. Each entry configures the update settings for a particular package manager. For more information, see [AUTOTITLE](/code-security/concepts/supply-chain-security/about-the-dependabot-yml-file) and [AUTOTITLE](/code-security/reference/supply-chain-security/dependabot-options-reference).
52
52
1. For each package manager, use:
53
53
54
-
* `package-ecosystem` to specify the package manager. For more information about the supported package managers, see [`package-ecosystem`](/code-security/dependabot/working-with-dependabot/dependabot-options-reference#package-ecosystem-).
55
-
* `directories` or `directory` to specify the location of multiple manifest or other definition files. For more information, see [Defining multiple locations for manifest files](/code-security/dependabot/dependabot-version-updates/controlling-dependencies-updated#defining-multiple-locations-for-manifest-files).
54
+
* `package-ecosystem` to specify the package manager. For more information about the supported package managers, see [`package-ecosystem`](/code-security/reference/supply-chain-security/dependabot-options-reference#package-ecosystem-).
55
+
* `directories` or `directory` to specify the location of multiple manifest or other definition files. For more information, see [Defining multiple locations for manifest files](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/controlling-dependencies-updated#defining-multiple-locations-for-manifest-files).
56
56
* `schedule.interval` to specify how often to check for new versions.
57
57
58
58
{% data reusables.dependabot.check-in-dependabot-yml %}
@@ -107,21 +107,21 @@ On a fork, you also need to explicitly enable {% data variables.product.prodname
107
107
108
108
## Receiving updates for indirect dependencies
109
109
110
-
By default, only direct dependencies that are explicitly defined in a manifest are kept up to date by {% data variables.product.prodname_dependabot_version_updates %}. You can choose to receive updates for indirect dependencies defined in lock files. For more information, see [AUTOTITLE](/code-security/dependabot/dependabot-version-updates/controlling-dependencies-updated#allowing-specific-dependencies-to-be-updated).
110
+
By default, only direct dependencies that are explicitly defined in a manifest are kept up to date by {% data variables.product.prodname_dependabot_version_updates %}. You can choose to receive updates for indirect dependencies defined in lock files. For more information, see [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/controlling-dependencies-updated#allowing-specific-dependencies-to-be-updated).
111
111
112
112
## Enabling access to private dependencies
113
113
114
114
{% data reusables.dependabot.private-dependencies-note %}
115
115
116
-
Additionally, {% data variables.product.prodname_dependabot %} doesn't support private {% data variables.product.prodname_dotcom %} dependencies for all package managers. For more information, see [AUTOTITLE](/code-security/dependabot/ecosystems-supported-by-dependabot/supported-ecosystems-and-repositories) and [AUTOTITLE](/get-started/learning-about-github/github-language-support).
116
+
Additionally, {% data variables.product.prodname_dependabot %} doesn't support private {% data variables.product.prodname_dotcom %} dependencies for all package managers. For more information, see [AUTOTITLE](/code-security/reference/supply-chain-security/supported-ecosystems-and-repositories) and [AUTOTITLE](/get-started/learning-about-github/github-language-support).
117
117
118
118
## Checking the status of version updates
119
119
120
120
After you enable version updates, the **Dependabot** tab in the dependency graph for the repository is populated. This tab shows which package managers {% data variables.product.prodname_dependabot %} is configured to monitor and when {% data variables.product.prodname_dependabot %} last checked for new versions.
121
121
122
122

123
123
124
-
For information, see [AUTOTITLE](/code-security/dependabot/troubleshooting-dependabot/listing-dependencies-configured-for-version-updates).
124
+
For information, see [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/list-configured-dependencies).
125
125
126
126
## Disabling {% data variables.product.prodname_dependabot_version_updates %}
127
127
@@ -168,4 +168,4 @@ updates:
168
168
update-types: ["version-update:semver-patch"]
169
169
```
170
170
171
-
For more information about checking for existing ignore preferences, see [AUTOTITLE](/code-security/dependabot/working-with-dependabot/dependabot-options-reference#ignore--).
171
+
For more information about checking for existing ignore preferences, see [AUTOTITLE](/code-security/reference/supply-chain-security/dependabot-options-reference#ignore--).
Copy file name to clipboardExpand all lines: content/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/configuring-multi-ecosystem-updates.md
+3-3Lines changed: 3 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -18,7 +18,7 @@ Multi-ecosystem updates allow you to consolidate {% data variables.product.prodn
18
18
19
19
## Prerequisites
20
20
* A repository with dependencies in multiple package ecosystems
21
-
* An existing `.github/dependabot.yml` file. See [AUTOTITLE](/code-security/dependabot/dependabot-version-updates/configuring-dependabot-version-updates).
21
+
* An existing `.github/dependabot.yml` file. See [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/configure-version-updates).
22
22
23
23
## 1. Define your multi-ecosystem group in your `.github/dependabot.yml` file
24
24
@@ -69,7 +69,7 @@ Commit the changes to your `dependabot.yml` file.
69
69
70
70
## 4. Customize with additional keys (optional)
71
71
72
-
You can add assignees, labels, or other configuration options to your multi-ecosystem groups. See [`assignees`](/code-security/dependabot/working-with-dependabot/dependabot-options-reference#assignees--) and [`labels`](/code-security/dependabot/working-with-dependabot/dependabot-options-reference#labels--).
72
+
You can add assignees, labels, or other configuration options to your multi-ecosystem groups. See [`assignees`](/code-security/reference/supply-chain-security/dependabot-options-reference#assignees--) and [`labels`](/code-security/reference/supply-chain-security/dependabot-options-reference#labels--).
73
73
74
74
```yaml copy
75
75
multi-ecosystem-groups:
@@ -111,4 +111,4 @@ If you're not seeing consolidated pull requests, ensure that:
Copy file name to clipboardExpand all lines: content/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/enable-dependency-graph.md
+7-7Lines changed: 7 additions & 7 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -17,7 +17,7 @@ category:
17
17
- Secure your dependencies
18
18
---
19
19
20
-
The dependency graph is a summary of the manifest and lock files stored in a repository and any dependencies that are submitted for the repository using the {% data variables.dependency-submission-api.name %}. For more information, see [AUTOTITLE](/code-security/supply-chain-security/understanding-your-software-supply-chain/about-the-dependency-graph).
20
+
The dependency graph is a summary of the manifest and lock files stored in a repository and any dependencies that are submitted for the repository using the {% data variables.dependency-submission-api.name %}. For more information, see [AUTOTITLE](/code-security/concepts/supply-chain-security/dependency-graph).
21
21
22
22
When the dependency graph is first enabled, any manifest and lock files for supported ecosystems are parsed immediately. The graph is usually populated within minutes but this may take longer for repositories with many dependencies. Once enabled, the graph is automatically updated with every push to the repository{% ifversion fpt or ghec %} and every push to other repositories in the graph{% endif %}.
23
23
@@ -37,23 +37,23 @@ Enabling the dependency graph gives {% data variables.product.github %} read-onl
37
37
38
38
## Enabling the dependency graph for multiple repositories
39
39
40
-
You can enable or disable the dependency graph for all repositories owned by your user account, regardless of their visibility. See [AUTOTITLE](/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-user-account-settings/managing-security-and-analysis-settings-for-your-personal-account).
40
+
You can enable or disable the dependency graph for all repositories owned by your user account, regardless of their visibility. See [AUTOTITLE](/account-and-profile/how-tos/account-settings/managing-security-and-analysis-features).
41
41
42
-
You can also enable the dependency graph for multiple repositories in an organization at the same time. For more information, see [AUTOTITLE](/code-security/securing-your-organization).
42
+
You can also enable the dependency graph for multiple repositories in an organization at the same time. For more information, see [AUTOTITLE](/code-security/how-tos/secure-at-scale/configure-organization-security).
43
43
44
44
{% endif %}
45
45
46
46
## Next steps
47
47
48
48
{% data reusables.dependency-submission.dependency-submission-link %}
49
49
50
-
For more information on viewing the dependency graph, see [AUTOTITLE](/code-security/supply-chain-security/understanding-your-software-supply-chain/exploring-the-dependencies-of-a-repository).
50
+
For more information on viewing the dependency graph, see [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/explore-dependencies).
Copy file name to clipboardExpand all lines: content/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/explore-dependencies.md
+8-8Lines changed: 8 additions & 8 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -24,7 +24,7 @@ category:
24
24
25
25
## Viewing the dependency graph
26
26
27
-
The dependency graph shows the dependencies{% ifversion fpt or ghec %} and dependents{% endif %} of your repository. {% data reusables.dependency-graph.repository-view-update %} For information about the detection of dependencies and which ecosystems are supported, see [AUTOTITLE](/code-security/supply-chain-security/understanding-your-software-supply-chain/dependency-graph-supported-package-ecosystems).
27
+
The dependency graph shows the dependencies{% ifversion fpt or ghec %} and dependents{% endif %} of your repository. {% data reusables.dependency-graph.repository-view-update %} For information about the detection of dependencies and which ecosystems are supported, see [AUTOTITLE](/code-security/reference/supply-chain-security/dependency-graph-supported-package-ecosystems).
28
28
29
29
{% data reusables.repositories.navigate-to-repo %}
30
30
{% data reusables.repositories.accessing-repository-graphs %}
@@ -42,7 +42,7 @@ The dependency graph shows the dependencies{% ifversion fpt or ghec %} and depen
42
42
{% endif %}
43
43
44
44
{% ifversion ghes %}
45
-
Enterprise owners can configure the dependency graph at an enterprise level. For more information, see [AUTOTITLE](/admin/code-security/managing-supply-chain-security-for-your-enterprise/enabling-the-dependency-graph-for-your-enterprise).
45
+
Enterprise owners can configure the dependency graph at an enterprise level. For more information, see [AUTOTITLE](/code-security/how-tos/secure-at-scale/configure-enterprise-security/configure-specific-tools/enable-dependency-graph).
46
46
{% endif %}
47
47
48
48
### Dependencies view
@@ -55,15 +55,15 @@ For each dependency, you can see its ecosystem, the manifest file in which it wa
55
55
* You can sort and filter dependencies by typing filters as `key:value` pairs into the search bar.
56
56
57
57
* Use `ecosystem: <ecosystem-name>` to display dependencies for the selected ecosystem.{% ifversion transitive-dependency-labeling-npm %}
58
-
* Use `relationship:` to filter the list by relationship status. Possible values are `direct`, `transitive`, and `inconclusive`. Alternatively, you can click the relationship label adjacent to a dependency name to only show dependencies of the same relationship status. This filter is only available for ecosystems with transitive dependency support. See [AUTOTITLE](/code-security/supply-chain-security/understanding-your-software-supply-chain/dependency-graph-supported-package-ecosystems) for more information.{% endif %}
58
+
* Use `relationship:` to filter the list by relationship status. Possible values are `direct`, `transitive`, and `inconclusive`. Alternatively, you can click the relationship label adjacent to a dependency name to only show dependencies of the same relationship status. This filter is only available for ecosystems with transitive dependency support. See [AUTOTITLE](/code-security/reference/supply-chain-security/dependency-graph-supported-package-ecosystems) for more information.{% endif %}
59
59
60
60
{% endif %}
61
61
62
62
{% ifversion ghes %}
63
63
Any direct and indirect dependencies that are specified in the repository's manifest or lock files are listed.
64
64
{% endif %}
65
65
66
-
Dependencies submitted to a project using the {% data variables.dependency-submission-api.name %} will show which detector was used for their submission and when they were submitted. For more information on using the {% data variables.dependency-submission-api.name %}, see [AUTOTITLE](/code-security/supply-chain-security/understanding-your-software-supply-chain/using-the-dependency-submission-api).
66
+
Dependencies submitted to a project using the {% data variables.dependency-submission-api.name %} will show which detector was used for their submission and when they were submitted. For more information on using the {% data variables.dependency-submission-api.name %}, see [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/use-dependency-submission-api).
67
67
68
68
If vulnerabilities have been detected in the repository, these are shown at the top of the view for users with access to {% data variables.product.prodname_dependabot_alerts %}.
69
69
@@ -84,9 +84,9 @@ For public repositories, the dependents view shows how the repository is used by
0 commit comments