You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: content/code-security/dependabot/dependabot-alerts/about-dependabot-alerts.md
+6-2Lines changed: 6 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -34,8 +34,6 @@ shortTitle: Dependabot alerts
34
34
35
35
If your code depends on a package with a security vulnerability, this can cause a range of problems for your project or the people who use it. You should upgrade to a secure version of the package as soon as possible.{% ifversion GH-advisory-db-supports-malware %} If your code uses malware, you need to replace the package with a secure alternative.{% endif %}
36
36
37
-
{% data reusables.security-advisory.link-browsing-advisory-db %}
38
-
39
37
{% data reusables.dependabot.quickstart-link %}
40
38
41
39
## Detection of insecure dependencies
@@ -89,6 +87,12 @@ When {% data variables.product.product_name %} identifies a vulnerable dependenc
89
87
90
88
{% data reusables.dependabot.dependabot-alert-create-PR %}
{% data reusables.dependabot.dependabot-alert-rules %}
93
+
94
+
{% endif %}
95
+
92
96
{% warning %}
93
97
94
98
**Note**: {% data variables.product.product_name %}'s security features do not claim to catch all vulnerabilities{% ifversion GH-advisory-db-supports-malware %} and malware{% endif %}. We actively maintain {% data variables.product.prodname_advisory_database %} and generate alerts with the most up-to-date information. However, we cannot catch everything or tell you about known vulnerabilities within a guaranteed time frame. These features are not substitutes for human review of each dependency for potential vulnerabilities or any other issues, and we recommend consulting with a security service or conducting a thorough dependency review when necessary.
Copy file name to clipboardExpand all lines: content/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts.md
+74-21Lines changed: 74 additions & 21 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,7 +1,7 @@
1
1
---
2
2
title: Using alert rules to prioritize Dependabot alerts
3
3
intro: 'You can use {% data variables.product.prodname_dependabot %} alert rules to filter out false positive alerts or alerts you''re not interested in.'
4
-
permissions: 'People with write permissions to a private repository can enable or disable {% data variables.product.prodname_dependabot %} alert rules for the repository.'
4
+
permissions: 'People with write permissions can view {% data variables.product.prodname_dependabot %} alert rules for the repository. People with with admin permissions to a repository, or the security manager role for the repository, can enable or disable {% data variables.product.prodname_dependabot %} alert rules for the repository{% ifversion dependabot-alert-custom-rules-repo-level %}, as well as create custom alert rules{% endif %}.'
## About {% data variables.product.prodname_dependabot %} alert rules
18
-
<!-- will need to review this procedural section for GHES -->
17
+
{% data reusables.dependabot.github-alert-rules-beta %}
19
18
20
-
{% data reusables.dependabot.github-curated-alert-rules-beta %}
19
+
## About {% data variables.product.prodname_dependabot %} alert rules
21
20
22
21
{% data variables.product.prodname_dependabot %} alert rules allow you to instruct {% data variables.product.prodname_dependabot %} to automatically dismiss or reopen certain alerts, based on complex logic from a variety of contextual criteria.
23
22
24
-
When enabled, the built-in `Dismiss low impact alerts` rule auto-dismisses certain types of vulnerabilities that are found in npm dependencies used in development. These alerts cover cases that feel like false alarms to most developers as the associated vulnerabilities:
25
-
- Are unlikely to be exploitable in a developer (non-production or runtime) environment.
26
-
- May relate to resource management, programming and logic, and information disclosure issues.
27
-
- At worst, have limited effects like slow builds or long-running tests.
There are two types of {% data variables.product.prodname_dependabot %} alert rules:
29
25
30
-
This {% data variables.product.company_short %}-curated `Dismiss low impact alerts` rule includes vulnerabilities relating to resource management, programming and logic, and information disclosure issues. For more information, see "[Publicly disclosed CWEs used by the Dismiss low impact rule](#publicly-disclosed-cwes-used-by-the-dismiss-low-impact-rule)."
26
+
- {% data variables.product.company_short %}-curated rules
27
+
- User-created custom rules
31
28
32
-
Filtering out these low impact alerts allows you to focus on alerts that matter to you, without having to worry about missing potentially high-risk development-scoped alerts.
29
+
{% data variables.product.company_short %}-curated rules are enabled by default for public repositories and can be opted into for private repositories. However, it's important to note that you cannot modify the {% data variables.product.company_short %}-curated rules. With user-created custom rules, you can create your own rules to automatically dismiss or reopen alerts based on your own criteria.{% endif %}
30
+
31
+
Whilst you may find it useful to auto-dismiss low impact alerts, you can still reopen auto-dismissed alerts and filter to see which alerts have been auto-dismissed. For more information, see "[Managing automatically dismissed alerts](#managing-automatically-dismissed-alerts)."
32
+
33
+
Additionally, auto-dismissed alerts are still available for reporting and reviewing, and can be auto-reopened if the alert metadata changes, for example:
34
+
- If you change the scope of a dependency from development to production.
35
+
- If {% data variables.product.company_short %} modifies certain metadata for the related advisory.
36
+
37
+
Auto-dismissed alerts are defined by the `resolution:auto-dismiss` close reason. Automatic dismissal activity is included in alert webhooks, REST and GraphQL APIs, and the audit log. For more information, see "[AUTOTITLE](/rest/dependabot/alerts)" in the REST API documentation, and the "`repository_vulnerability_alert` " section in "[AUTOTITLE](/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#repository_vulnerability_alert-category-actions)."
38
+
39
+
## About {% data variables.product.company_short %}-curated rules
33
40
34
41
{% note %}
35
42
36
43
**Note:** Automatic dismissal of low impact development alerts is currently only supported for npm.
37
44
38
45
{% endnote %}
39
46
40
-
Whilst you may find it useful to auto-dismiss low impact alerts, you can still reopen auto-dismissed alerts, and filter to see which alerts have been auto-dismissed. For more information, see "[Managing automatically dismissed alerts](#managing-automatically-dismissed-alerts)."
47
+
When enabled, the built-in `Dismiss low impact alerts` rule auto-dismisses certain types of vulnerabilities that are found in npm dependencies used in development. These alerts cover cases that feel like false alarms to most developers as the associated vulnerabilities:
41
48
42
-
Additionally, auto-dismissed alerts are still available for reporting and reviewing, and can be re-introduced as not having been dismissed if the alert metadata changes, for example:
43
-
- If you change the scope of a dependency from development to production.
44
-
- If {% data variables.product.company_short %} modifies certain metadata for the related advisory.
49
+
- Are unlikely to be exploitable in a developer (non-production or runtime) environment.
50
+
- May relate to resource management, programming and logic, and information disclosure issues.
51
+
- At worst, have limited effects like slow builds or long-running tests.
52
+
- Are not indicative of issues in production.
45
53
46
-
Auto-dismissed alerts are defined by the `resolution:auto-dismiss` close reason. Automatic dismissal activity is included in alert webhooks, REST and GraphQL APIs, and the audit log. For more information, see "[AUTOTITLE](/rest/dependabot/alerts)" in the REST API documentation, and the "`repository_vulnerability_alert` " section in "[Reviewing the audit log for your organization](/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#repository_vulnerability_alert-category-actions)."
54
+
This {% data variables.product.company_short %}-curated `Dismiss low impact alerts` rule includes vulnerabilities relating to resource management, programming and logic, and information disclosure issues. For more information, see "[Publicly disclosed CWEs used by the `Dismiss low impact alerts` rule](#publicly-disclosed-cwes-used-by-the-dismiss-low-impact-alerts-rule)."
47
55
48
-
By default, {% data variables.product.company_short %}-curated {% data variables.product.prodname_dependabot %} alert rules are enabled on public repositories and disabled for private repositories. Administrators of private repositories can opt in by enabling alert rules for their repository. For more information, see "[Enabling {% data variables.product.prodname_dependabot %} alert rules for your private repository](#enabling-dependabot-alert-rules-for-your-private-repository)."
56
+
Filtering out these low impact alerts allows you to focus on alerts that matter to you, without having to worry about missing potentially high-risk development-scoped alerts.
57
+
58
+
By default, {% data variables.product.company_short %}-curated {% data variables.product.prodname_dependabot %} alert rules are enabled on public repositories and disabled for private repositories. Administrators of private repositories can opt in by enabling alert rules for their repository.
49
59
50
-
## Enabling {% data variables.product.prodname_dependabot %} alert rules for your private repository
60
+
###Enabling the `Dismiss low impact alerts` rule for your private repository
51
61
52
62
{% ifversion fpt or ghec %}You first need to enable {% data variables.product.prodname_dependabot_alerts %} for the repository. For more information, see "[AUTOTITLE](/code-security/dependabot/dependabot-alerts/configuring-dependabot-alerts#managing-dependabot-alerts-for-your-repository)."{% elsif ghes %}{% data variables.product.prodname_dependabot_alerts %} for your repository can be enabled or disabled by your enterprise owner. For more information, see "[AUTOTITLE](/admin/configuration/configuring-github-connect/enabling-dependabot-for-your-enterprise)."{% endif %}
53
63
54
-
{% ifversion fpt or ghec %}
55
64
{% data reusables.repositories.navigate-to-repo %}
56
65
{% data reusables.repositories.sidebar-settings %}
57
66
{% data reusables.repositories.navigate-to-code-security-and-analysis %}
1. Under "{% data variables.product.prodname_dependabot_alerts %}", click {% octicon "gear" aria-label="The Gear icon" %} close to "{% data variables.product.prodname_dependabot %} rules".
69
+
70
+
71
+
72
+
1. Select **Dismiss low impact alerts**.
73
+
1. Click **Save rules**.
74
+
{% else %}
58
75
1. Under "{% data variables.product.prodname_dependabot_alerts %}", click **Dismiss low impact alerts**.
76
+
59
77
You can create your own {% data variables.product.prodname_dependabot %} alert rules based on alert criteria.
85
+
86
+
- Dependency scope (`devDependency` or `runtime`)
87
+
- Package name
88
+
- CWE
89
+
- Severity
90
+
- Patch availability
91
+
- Manifest path
92
+
- Ecosystem
93
+
94
+
### Adding a custom rule to your repository
95
+
96
+
You can add a custom rule to your {% ifversion fpt %}public and private{% elsif ghec or ghes %}public, private, and internal{% endif %} repositories.
97
+
98
+
{% data reusables.repositories.navigate-to-repo %}
99
+
{% data reusables.repositories.sidebar-settings %}
100
+
{% data reusables.repositories.navigate-to-code-security-and-analysis %}
101
+
1. Under "{% data variables.product.prodname_dependabot_alerts %}", click {% octicon "gear" aria-label="The Gear icon" %} close to "{% data variables.product.prodname_dependabot %} rules".
102
+
103
+
104
+
105
+
1. Click **New ruleset**.
106
+
107
+
108
+
109
+
1. Under "Name", describe what this rule will do.
110
+
1. Under "Alert criteria", select the criteria you want to use to filter alerts.
111
+
1. Under "Rules", select the action you want to take on alerts that match the criteria.
112
+
1. Click **Create rule**.
113
+
60
114
{% endif %}
61
115
62
116
## Managing automatically dismissed alerts
63
-
<!-- will need to review this procedural section for GHES -->
64
117
65
118
You can filter to see which alerts have been auto-dismissed, and you can reopen dismissed alerts.
66
119
@@ -84,7 +137,7 @@ You can filter to see which alerts have been auto-dismissed, and you can reopen
84
137
85
138
86
139
87
-
## Publicly disclosed CWEs used by the Dismiss low impact rule
140
+
## Publicly disclosed CWEs used by the `Dismiss low impact alerts` rule
88
141
89
142
Along with the `ecosystem:npm` and `scope:development` alert metadata, we use the following {% data variables.product.company_short %}-curated Common Weakness Enumerations (CWEs) to filter out low impact alerts for the `Dismiss low impact alerts` rule. We regularly improve this list and vulnerability patterns covered by built-in rules.
Copy file name to clipboardExpand all lines: content/code-security/getting-started/securing-your-repository.md
+6Lines changed: 6 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -54,6 +54,12 @@ For more information, see "[AUTOTITLE](/code-security/supply-chain-security/unde
54
54
55
55
{% data variables.product.prodname_dependabot_alerts %} are generated when {% data variables.product.prodname_dotcom %} identifies a dependency in the dependency graph with a vulnerability. {% ifversion fpt or ghec %}You can enable {% data variables.product.prodname_dependabot_alerts %} for any repository.{% endif %}
Additionally, you can use {% data variables.product.prodname_dependabot %} alert rules to filter out false positive alerts or alerts you're not interested in, based on complex logic from a variety of contextual criteria. For more information, see "[AUTOTITLE](/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts)."
0 commit comments