Dependency management and Dependabot
To manage your dependencies, you can use Software Composition Analysis (SCA) tools. GitHub offers Dependency graphs, Dependabot alerts, and Dependabot security updates to manage your software dependencies.
Dependency graph helps you to understand your dependency tree. Dependabot alerts check your dependencies for known vulnerabilities and alert you in case Dependabot finds any. If you enable Dependabot security updates, Dependabot will automatically create pull requests that update your dependencies if the author of the dependent package releases a fix for a vulnerability.
The dependency graph is enabled by default for public repositories but not for private ones. Dependabot alerts and updates must be enabled for all repositories. You can do this under Settings | Security & Analysis (see Figure 14.1):
Figure 14.1 – Enable the dependency graph and Dependabot
On the organizational level, you can enable these...
