Dependabot alerts
What it is
Dependabot alerts identify known vulnerable dependencies declared in a supported repository’s dependency graph. They help a team find components affected by published security advisories.
Why it exists
An application can be vulnerable even when its own source code has no obvious flaw. Transitive and direct dependencies need continuous visibility as new advisories appear.
Key ideas
- An alert is a signal to assess exposure; it is not proof that the vulnerable code path is reachable in your application.
- Triage by severity, exploitability, reachability, business impact, available fix, and compensating controls. Record accepted risk with an owner and review date.
- Automated update pull requests reduce routine patching effort but still require tests, compatibility review, and normal branch protection.
- Dependency alerting complements—not replaces—license scanning, SBOMs, package provenance, and container scanning.
Related
dependency-vulnerabilities · github-advanced-security · dependency-management
Source: About Dependabot alerts