World map

 

BM

World 8: Shields: Security

Dependabot alerts

You will learn: how GitHub warns you about unsafe packages, and how to fix them.

The problem

Your diary uses packages other people wrote. One day, one of them gets a security hole. Would you even know?

Watch

Dependabot: GitHub's helper that warns about unsafe packages and can open pull requests to update them. is GitHub’s helper robot. It checks your dependency: Code written by others that your project uses, like a package. against a big list of known holes. Finds a match? You get an alert.

Try it

Here is an alert. Tap the line that tells you the fix.

Tap the line that tells you the fix.

0 of 1 found

Watch

Dependabot can even do the fix. A security update is a pull request it opens for you. It moves the package to the fixed version. You check it, then merge.

Try it

An alert arrives. Put your steps in order, first at the top.

First step at the top. Put these in order. Use the arrows, or drag.

  • Check that your tests still pass
  • Read the alert: which package, how bad
  • Open the update pull request
  • Merge it to close the hole

Predict

The alert says the fix is in 1.0.3. Which version should you move to?

You did it!

You can now act on a Dependabot alert.

Go deeper (optional)

Alerts come from the GitHub Advisory Database. It is a big public list of known vulnerability: A security hole that an attacker could use.. Dependabot watches your default branch. Version updates are different: they keep packages fresh, holes or not. World 7 shows those.