You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: content/code-security/dependabot/dependabot-security-updates/configuring-dependabot-security-updates.md
+25Lines changed: 25 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -73,6 +73,31 @@ You can also enable or disable {% data variables.product.prodname_dependabot_sec
73
73
1. Under "Code security and analysis", to the right of "{% data variables.product.prodname_dependabot %} security updates", click **Enable** to enable the feature or **Disable** to disable it. {% ifversion fpt or ghec %}For public repositories, the button is disabled if the feature is always enabled.{% endif %}
74
74
{% ifversion fpt or ghec %}{% else %}{% endif %}
75
75
76
+
## Overriding the default behavior with a configuration file
77
+
78
+
You can override the default behavior of {% data variables.product.prodname_dependabot_security_updates %} by adding a dependabot.yml file to your repository. For more information, see "[Configuration options for the dependabot.yml file](/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file)."
79
+
80
+
If you only require security updates and want to exclude version updates, you can set `open-pull-request-limit` to `0` in order to prevent version updates for a given `package-ecosystem`. For more information, see "[`open-pull-request-limit`](/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#open-pull-requests-limit)."
81
+
82
+
```
83
+
# Example configuration file that:
84
+
# - Ignores lodash dependency
85
+
# - Disables version-updates
86
+
87
+
version: 2
88
+
updates:
89
+
- package-ecosystem: "npm"
90
+
directory: "/"
91
+
schedule:
92
+
interval: "daily"
93
+
ignore:
94
+
- dependency-name: "lodash"
95
+
# For Lodash, ignore all updates
96
+
# Disable version updates for npm dependencies
97
+
open-pull-requests-limit: 0
98
+
```
99
+
100
+
For more information about the configuration options available for security updates, see the table in "[Configuration options for the dependabot.yml file](/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#configuration-options-for-the-dependabotyml-file)."
Copy file name to clipboardExpand all lines: content/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file.md
+2-25Lines changed: 2 additions & 25 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -35,34 +35,11 @@ Any options that also affect security updates are used the next time a security
35
35
36
36
The *dependabot.yml* file has two mandatory top-level keys: `version`, and `updates`. You can, optionally, include a top-level `registries` key{% ifversion fpt or ghec or ghes > 3.4 %} and/or a `enable-beta-ecosystems` key{% endif %}. The file must start with `version: 2`.
37
37
38
-
## Configuration options for updates
38
+
## Configuration options for the *dependabot.yml* file
39
39
40
40
The top-level `updates` key is mandatory. You use it to configure how {% data variables.product.prodname_dependabot %} updates the versions or your project's dependencies. Each entry configures the update settings for a particular package manager. You can use the following options.
41
41
42
-
| Option | Required | Description |
43
-
|:---|:---:|:---|
44
-
|[`package-ecosystem`](#package-ecosystem)|**X**| Package manager to use |
45
-
|[`directory`](#directory)|**X**| Location of package manifests |
46
-
|[`schedule.interval`](#scheduleinterval)|**X**| How often to check for updates |
47
-
|[`allow`](#allow)|| Customize which updates are allowed |
48
-
|[`assignees`](#assignees)|| Assignees to set on pull requests |
49
-
| [`commit-message`](#commit-message) | | Commit message preferences |{% ifversion fpt or ghec or ghes > 3.4 %}
50
-
| [`enable-beta-ecosystems`](#enable-beta-ecosystems) | | Enable ecosystems that have beta-level support |{% endif %}
51
-
|[`ignore`](#ignore)|| Ignore certain dependencies or versions |
52
-
|[`insecure-external-code-execution`](#insecure-external-code-execution)|| Allow or deny code execution in manifest files |
53
-
|[`labels`](#labels)|| Labels to set on pull requests |
54
-
|[`milestone`](#milestone)|| Milestone to set on pull requests |
55
-
|[`open-pull-requests-limit`](#open-pull-requests-limit)|| Limit number of open pull requests for version updates|
56
-
|[`pull-request-branch-name.separator`](#pull-request-branch-nameseparator)|| Change separator for pull request branch names |
Copy file name to clipboardExpand all lines: content/code-security/dependabot/working-with-dependabot/troubleshooting-the-detection-of-vulnerable-dependencies.md
+6Lines changed: 6 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -84,6 +84,12 @@ The {% data variables.product.prodname_dependabot_alerts %} count in {% data var
84
84
**Check**: If there is a discrepancy in the totals you are seeing, check that you are not comparing alert numbers with dependency numbers. Also check that you are viewing all alerts and not a subset of filtered alerts.
85
85
{% endif %}
86
86
87
+
{% ifversion fpt or ghec or ghes > 3.2 %}
88
+
## Can Dependabot ignore specific dependencies?
89
+
90
+
You can configure {% data variables.product.prodname_dependabot %} to ignore specific dependencies in the configuration file, which will prevent security and version updates for those dependencies. If you only wish to use security updates, you will need to override the default behavior with a configuration file. For more information, see "[Overriding the default behavior with a configuration file](/code-security/dependabot/dependabot-security-updates/configuring-dependabot-security-updates#overriding-the-default-behavior-with-a-configuration-file) to prevent version updates from being activated. For information about ignoring dependencies, see "[`ignore`](/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#ignore)."
91
+
{% endif %}
92
+
87
93
## Further reading
88
94
89
95
- "[About {% data variables.product.prodname_dependabot_alerts %}](/code-security/supply-chain-security/about-alerts-for-vulnerable-dependencies)"
Copy file name to clipboardExpand all lines: content/code-security/supply-chain-security/understanding-your-software-supply-chain/about-supply-chain-security.md
+2Lines changed: 2 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -116,8 +116,10 @@ There are two types of {% data variables.product.prodname_dependabot_updates %}:
116
116
- Triggered by a {% data variables.product.prodname_dependabot %} alert
117
117
- Update dependencies to the minimum version that resolves a known vulnerability
118
118
- Supported for ecosystems the dependency graph supports
119
+
- Does not require a configuration file, but you can use one to override the default behavior
119
120
120
121
{% data variables.product.prodname_dependabot_version_updates %}:
122
+
- Requires a configuration file
121
123
- Run on a schedule you configure
122
124
- Update dependencies to the latest version that matches the configuration
|[`package-ecosystem`](/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#package-ecosystem)|**X**|| X | Package manager to use |
4
+
|[`directory`](/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#directory)|**X**|| X | Location of package manifests |
5
+
|[`schedule.interval`](/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#scheduleinterval)|**X**|| X | How often to check for updates |
6
+
|[`allow`](/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#allow)|| X | X | Customize which updates are allowed |
7
+
|[`assignees`](/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#assignees)|| X | X | Assignees to set on pull requests |
8
+
| [`commit-message`](/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#commit-message) | | X | X | Commit message preferences |{% ifversion fpt or ghec or ghes > 3.4 %}
9
+
| [`enable-beta-ecosystems`](/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#enable-beta-ecosystems) | | | X | Enable ecosystems that have beta-level support |{% endif %}
10
+
|[`ignore`](/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#ignore)|| X | X | Ignore certain dependencies or versions |
11
+
|[`insecure-external-code-execution`](/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#insecure-external-code-execution)||| X | Allow or deny code execution in manifest files |
12
+
|[`labels`](/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#labels)|| X | X | Labels to set on pull requests |
13
+
|[`milestone`](/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#milestone)|| X | X | Milestone to set on pull requests |
14
+
|[`open-pull-requests-limit`](#open-pull-requests-limit)|| X | X | Limit number of open pull requests for version updates |
15
+
|[`pull-request-branch-name.separator`](/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#pull-request-branch-nameseparator)|| X | X | Change separator for pull request branch names |
16
+
|[`rebase-strategy`](/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#rebase-strategy)|| X | X | Disable automatic rebasing |
17
+
|[`registries`](/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#registries)||| X | Private registries that {% data variables.product.prodname_dependabot %} can access|
18
+
|[`reviewers`](/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#reviewers)|| X | X | Reviewers to set on pull requests |
19
+
|[`schedule.day`](/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#scheduleday)||| X | Day of week to check for updates |
20
+
|[`schedule.time`](/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#scheduletime)||| X | Time of day to check for updates (hh:mm) |
21
+
|[`schedule.timezone`](/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#scheduletimezone)||| X | Timezone for time of day (zone identifier) |
22
+
|[`target-branch`](/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#target-branch)|| X | X | Branch to create pull requests against |
23
+
|[`vendor`](/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#vendor)||| X | Update vendored or cached dependencies |
24
+
|[`versioning-strategy`](/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#versioning-strategy)|| X | X | How to update manifest version requirements |
0 commit comments