Skip to content

Update responsible-use-autofix-code-scanning to recomend dependabot #38446

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
yeikel wants to merge 1 commit into from
Closed

Update responsible-use-autofix-code-scanning to recomend dependabot #38446

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions ...scanning/managing-code-scanning-alerts/responsible-use-autofix-code-scanning.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -109,6 +109,9 @@ Sometimes a suggested fix includes a change in the dependencies of the codebase.
* _Unsupported or insecure dependencies:_ The system does not know which versions of an existing dependency are supported or secure.
* _Fabricated dependencies:_ The system has incomplete knowledge of the dependencies published in the wider ecosystem. This can lead to suggestions that add a new dependency on malicious software that attackers have published under a statistically probable dependency name.

> [!NOTE]
> Our comprehensive dependency management recommendation continues to be “[AUTOTITLE](/code-security/dependabot)“

## Mitigating the limitations of suggestions

The best way to mitigate the limitations of suggestions from {% data variables.product.prodname_copilot_autofix_short %} is to follow best practices. For example, using CI testing of pull requests to verify functional requirements are unaffected and using dependency management solutions, such as the dependency review API and action. For more information, see “[AUTOTITLE](/code-security/supply-chain-security/understanding-your-software-supply-chain/about-dependency-review).”
Expand Down
Loading