From the course: GitHub Advanced Security Cert Prep by Microsoft Press

Unlock this course with a free trial

Join today to access over 24,700 courses taught by industry experts.

Identify a vulnerable dependency from a Dependabot alert

Identify a vulnerable dependency from a Dependabot alert - GitHub Tutorial

From the course: GitHub Advanced Security Cert Prep by Microsoft Press

Start my 1-month free trial Buy for my team

Identify a vulnerable dependency from a Dependabot alert

“

- [Narrator] Now would be a good time for us to formally distinguish the two main types of dependencies. We've got direct dependencies that are libraries or packages used directly by your code, and then we also need to be concerned with our transitive dependencies. These are libraries or packages that your direct dependencies need to function, hence Dependabot giving us coverage for both of these dependency types. We've seen over the previous couple lessons, that Dependabot alerts clearly highlight your affected dependencies, and they also give you a full workup on what the vulnerability is, what the severity level is. Now, new in this lesson is I'm going to teach you how to query Dependabot alerts programmatically instead of in the GitHub UI that we've been doing thus far. I want you to know we can communicate with GitHub resources using either GitHub's native rest API, or we can use GraphQL. In the GitHub UI, or frankly in the JSON response when we're doing an API request, well, I…

Contents