{"meta":{"title":"Dependabot quickstart guide","intro":"Find and fix vulnerable dependencies you rely on with Dependabot.","product":"Security and code quality","breadcrumbs":[{"href":"/en/code-security","title":"Security and code quality"},{"href":"/en/code-security/tutorials","title":"Tutorials"},{"href":"/en/code-security/tutorials/secure-your-dependencies","title":"Secure your dependencies"},{"href":"/en/code-security/tutorials/secure-your-dependencies/dependabot-quickstart-guide","title":"Dependabot quickstart"}],"documentType":"article"},"body":"# Dependabot quickstart guide\n\nFind and fix vulnerable dependencies you rely on with Dependabot.\n\n## About Dependabot\n\nThis quickstart guide walks you through setting up and enabling Dependabot, viewing Dependabot alerts, and updating your repository to use a secure version of the dependency.\n\nDependabot consists of three different features that help you manage your dependencies:\n\n* Dependabot alerts: Inform you about vulnerabilities in the dependencies that you use in your repository.\n* Dependabot security updates: Automatically raise pull requests to update the dependencies you use that have known security vulnerabilities.\n* Dependabot version updates: Automatically raise pull requests to keep your dependencies up-to-date.\n\n## Prerequisites\n\nFor the purpose of this guide, we're going to use a demo repository to illustrate how Dependabot finds vulnerabilities in dependencies, where you can see Dependabot alerts on GitHub, and how you can explore, fix, or dismiss these alerts.\n\nYou need to start by forking the demo repository.\n\n1. Navigate to [https://github.com/dependabot/demo](https://github.com/dependabot/demo?ref_product=supply-chain-security\\&ref_type=engagement\\&ref_style=text).\n2. At the top of the page, on the right, click ** Fork**.\n3. Select an owner (you can select your GitHub personal account) and type a repository name. For more information about forking repositories, see [Fork a repository](/en/pull-requests/collaborating-with-pull-requests/working-with-forks/fork-a-repo#forking-a-repository).\n4. Click **Create fork**.\n\n## Enabling Dependabot for your repository\n\nYou need to follow the steps below on the repository you forked in [Prerequisites](#prerequisites).\n\n1. On GitHub, navigate to the main page of the repository.\n2. Under your repository name, click ** Settings**. If you cannot see the \"Settings\" tab, select the **** dropdown menu, then click **Settings**.\n\n \n3. In the \"Security\" section of the sidebar, click ** Advanced Security**.\n4. Under \"Dependabot\", click **Enable** for Dependabot alerts, Dependabot security updates, and Dependabot version updates.\n5. If you clicked **Enable** for Dependabot version updates, you can edit the default `dependabot.yml` configuration file that GitHub creates for you in the `/.github` directory of your repository.\n To enable Dependabot version updates for your repository, you typically configure this file to suit your needs by editing the default file, and committing your changes. You can refer to the snippet provided in [Configuring Dependabot version updates](/en/code-security/dependabot/dependabot-version-updates/configuring-dependabot-version-updates#example-dependabotyml-file) for an example.\n\n> \\[!NOTE]\n> If the dependency graph is not already enabled for the repository, GitHub will enable it automatically when you enable Dependabot.\n\nFor more information about configuring each of these Dependabot features, see [Configuring Dependabot alerts](/en/code-security/dependabot/dependabot-alerts/configuring-dependabot-alerts), [Configuring Dependabot security updates](/en/code-security/dependabot/dependabot-security-updates/configuring-dependabot-security-updates), and [Configuring Dependabot version updates](/en/code-security/dependabot/dependabot-version-updates/configuring-dependabot-version-updates).\n\n## Viewing Dependabot alerts for your repository\n\nIf Dependabot alerts are enabled for a repository, you can view Dependabot alerts on the ** Security and quality** tab for the repository. You can use the forked repository that you enabled Dependabot alerts on in the previous section.\n\n1. On GitHub, navigate to the main page of the repository.\n\n2. Under the repository name, click the ** Security and quality** tab. If you cannot see the \" Security and quality\" tab, select the **** dropdown menu, and then click ** Security and quality**.\n\n3. In the \"Findings\" section of the sidebar, select the **Dependabot** dropdown menu, then click **Vulnerabilities**.\n\n4. Review the open alerts on the Dependabot alerts page. By default, the page displays the **Open** tab, listing the open alerts. (You'll be able to view any closed alerts by clicking **Closed**.)\n\n \n\n You can filter Dependabot alerts in the list, using a variety of filters or labels. For more information, see [Viewing and updating Dependabot alerts](/en/code-security/dependabot/dependabot-alerts/viewing-and-updating-dependabot-alerts#prioritizing-dependabot-alerts). You can also use Dependabot auto-triage rules to filter out false positive alerts or alerts you're not interested in. For more information, see [About Dependabot auto-triage rules](/en/code-security/dependabot/dependabot-auto-triage-rules/about-dependabot-auto-triage-rules).\n\n5. Click the \"Command Injection in lodash\" alert on the `javascript/package-lock.json` file. The details page for the alert will show the following information (note that some information may not apply to all alerts):\n\n * Whether Dependabot created a pull request that will fix the vulnerability. You can review the suggested security update by clicking **Review security update**.\n * Package involved\n * Affected versions\n * Patched version\n * Brief description of the vulnerability\n\n \n\n6. Optionally, you can also explore the information on the right-side of the page. Some of the information shown in the screenshot may not apply to every alert.\n\n * Severity\n * CVSS metrics: We use CVSS levels to assign severity levels. For more information, see [About the GitHub Advisory database](/en/code-security/security-advisories/working-with-global-security-advisories-from-the-github-advisory-database/about-the-github-advisory-database#about-cvss-levels).\n * Tags\n * Weaknesses: List of CWEs related to the vulnerability, if applicable\n * CVE ID: Unique CVE identifier for the vulnerability, if applicable\n * GHSA ID: Unique identifier of the corresponding advisory on the GitHub Advisory Database. For more information, see [About the GitHub Advisory database](/en/code-security/security-advisories/working-with-global-security-advisories-from-the-github-advisory-database/about-the-github-advisory-database#about-ghsa-ids).\n * Option to navigate to the advisory on the GitHub Advisory Database\n * Option to see all of your repositories that are affected by this vulnerability\n * Option to suggest improvements for this advisory on the GitHub Advisory Database\n\n \n\nFor more information about viewing, prioritizing, and sorting Dependabot alerts, see [Viewing and updating Dependabot alerts](/en/code-security/dependabot/dependabot-alerts/viewing-and-updating-dependabot-alerts).\n\n## Fixing or dismissing a Dependabot alert\n\nYou can fix or dismiss Dependabot alerts on GitHub. Let's continue to use the forked repository as an example, and the \"Command Injection in lodash\" alert described in the previous section.\n\n1. Navigate to the Dependabot tab for the repository. For more information, see the [Viewing Dependabot alerts for your repository](#viewing-dependabot-alerts-for-your-repository) section above.\n2. Click an alert.\n3. Click the \"Command Injection in lodash\" alert on the `javascript/package-lock.json` file.\n4. Review the alert. You can:\n * Review the suggested security update by clicking **Review security update**. This will open the pull request generated by Dependabot with the security fix.\n\n \n\n * On the pull request description, you can click **Commits** to explore the commits included in the pull request.\n * You can also click **Dependabot commands and options** to learn about the commands that you can use to interact with the pull request.\n * When you're ready to update your dependency and resolve the vulnerability, merge the pull request.\n * If you decide that you want to dismiss the alert\n * Go back to the alert details page.\n\n * On the top-right corner, click **Dismiss alert**.\n\n \n\n * Select a reason for dismissing the alert.\n\n * Optionally, add a dismissal comment. The dismissal comment will be added to the alert timeline and can be used as justification during auditing and reporting.\n\n * Click **Dismiss alert**. The alert won't appear anymore in the **Open** tab of the alert list, and you are able to view it in the **Closed** tab.\n\nFor more information about reviewing and updating Dependabot alerts, see [Viewing and updating Dependabot alerts](/en/code-security/dependabot/dependabot-alerts/viewing-and-updating-dependabot-alerts#reviewing-and-fixing-alerts).\n\n## Troubleshooting\n\nYou may need to do some troubleshooting if:\n\n* Dependabot is blocked from creating a pull request to fix an alert, or\n* The information reported by Dependabot is not what you expect.\n\nFor more information, see [Dependabot errors](/en/code-security/dependabot/troubleshooting-dependabot/troubleshooting-dependabot-errors) and [Vulnerable dependency detection](/en/code-security/dependabot/troubleshooting-dependabot/troubleshooting-the-detection-of-vulnerable-dependencies), respectively.\n\n## Next steps\n\nFor more information about configuring Dependabot updates, see [Configuring Dependabot security updates](/en/code-security/dependabot/dependabot-security-updates/configuring-dependabot-security-updates) and [Configuring Dependabot version updates](/en/code-security/dependabot/dependabot-version-updates/configuring-dependabot-version-updates).\n\nFor more information about configuring Dependabot for an organization, see [Configuring Dependabot alerts](/en/code-security/dependabot/dependabot-alerts/configuring-dependabot-alerts#managing-dependabot-alerts-for-your-organization).\n\nFor more information about viewing pull requests opened by Dependabot, see [Managing pull requests for dependency updates](/en/code-security/dependabot/working-with-dependabot/managing-pull-requests-for-dependency-updates#viewing-dependabot-pull-requests).\n\nFor more information about the security advisories that contribute to Dependabot alerts, see [Browsing security advisories in the GitHub Advisory Database](/en/code-security/security-advisories/working-with-global-security-advisories-from-the-github-advisory-database/browsing-security-advisories-in-the-github-advisory-database).\n\nFor more information about configuring notifications about Dependabot alerts, see [Configuring notifications for Dependabot alerts](/en/code-security/dependabot/dependabot-alerts/configuring-notifications-for-dependabot-alerts)."}