Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

📖 Dependabot config file link #1498

Merged
merged 3 commits into from
Jan 21, 2022
Merged

📖 Dependabot config file link #1498

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
7b468a0
Dependabot config file link
hholi Jan 20, 2022
68ec174
Updated dependabot docs link
hholi Jan 21, 2022
5093d75
Merge branch 'main' into patch-1
naveensrinivasan Jan 21, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions docs/checks.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -291,7 +291,7 @@ The highest score is awarded when all workflows avoid the dangerous code pattern
Risk: `High` (possibly vulnerable to attacks on known flaws)

This check tries to determine if the project uses a dependency update tool,
specifically [dependabot](https://dependabot.com/docs/config-file/) or
specifically [dependabot](https://docs.github.com/en/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/configuration-options-for-dependency-updates) or
[renovatebot](https://docs.renovatebot.com/configuration-options/). Out-of-date
dependencies make a project vulnerable to known flaws and prone to attacks.
These tools automate the process of updating dependencies by scanning for
Expand All @@ -309,7 +309,7 @@ low score is therefore not a definitive indication that the project is at risk.


**Remediation steps**
- Signup for automatic dependency updates with [dependabot](https://dependabot.com/docs/config-file/) or [renovatebot](https://docs.renovatebot.com/configuration-options/) and place the config file in the locations that are recommended by these tools. Due to https://github.com/dependabot/dependabot-core/issues/2804 Dependabot can be enabled for forks where security updates have ever been turned on so projects maintaining stable forks should evaluate whether this behavior is satisfactory before turning it on.
- Signup for automatic dependency updates with [dependabot](https://docs.github.com/en/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/configuration-options-for-dependency-updates) or [renovatebot](https://docs.renovatebot.com/configuration-options/) and place the config file in the locations that are recommended by these tools. Due to https://github.com/dependabot/dependabot-core/issues/2804 Dependabot can be enabled for forks where security updates have ever been turned on so projects maintaining stable forks should evaluate whether this behavior is satisfactory before turning it on.

## Fuzzing

Expand Down
4 changes: 2 additions & 2 deletions docs/checks/internal/checks.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,7 +50,7 @@ checks:
Risk: `High` (possibly vulnerable to attacks on known flaws)

This check tries to determine if the project uses a dependency update tool,
specifically [dependabot](https://dependabot.com/docs/config-file/) or
specifically [dependabot](https://docs.github.com/en/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/configuration-options-for-dependency-updates) or
[renovatebot](https://docs.renovatebot.com/configuration-options/). Out-of-date
dependencies make a project vulnerable to known flaws and prone to attacks.
These tools automate the process of updating dependencies by scanning for
Expand All @@ -69,7 +69,7 @@ checks:
remediation:
- >-
Signup for automatic dependency updates with
[dependabot](https://dependabot.com/docs/config-file/) or
[dependabot](https://docs.github.com/en/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/configuration-options-for-dependency-updates) or
[renovatebot](https://docs.renovatebot.com/configuration-options/) and place
the config file in the locations that are recommended by these tools. Due to
https://github.com/dependabot/dependabot-core/issues/2804 Dependabot can
Expand Down