Enable Dependabot alerts and security updates
Implementation Effort: Low – Turning on the dependency graph, Dependabot alerts, and security updates is a quick settings change per repository or organization. User Impact: Low – Dependabot raises alerts and opens remediation pull requests for maintainers to review; end users are not affected. Lifecycle Stage: Code
Overview
Enable Dependabot alerts and security updates on GitHub, and enable dependency scanning in GitHub Advanced Security for Azure DevOps, so known vulnerable packages are identified as soon as advisories are published.
Prerequisites:
Azure DevOps: License and enable GitHub Advanced Security for Azure DevOps.
GitHub: Enable the dependency graph and Dependabot alerts or Dependabot security updates in repository settings.
On GitHub, Dependabot alerts monitor the repository dependency graph and Dependabot security updates can automatically open pull requests that upgrade vulnerable packages to the nearest safe version. When a known vulnerability is disclosed, the tooling generates an alert with severity, affected component, and CVE details.
Dependabot supports grouped updates to batch related dependency upgrades into a single pull request, reducing manual review overhead for low-risk changes.
Enable auto-merge for Dependabot pull requests only when all of the following are true: required CI checks, including regression coverage, pass; the change is limited to patch-level updates for non-critical dependencies; dependency review confirms no new vulnerabilities or licensing issues; and the repository has a tested rollback path.
Prefer manual review for minor-version updates because behavior changes may still slip past automated tests.
On Azure DevOps, GitHub Advanced Security for Azure DevOps performs dependency scanning through pipeline-based analysis and generates dependency vulnerability alerts and pull request annotations. Dependabot security updates are also available for Azure Repos and can automatically open remediation pull requests that upgrade a vulnerable dependency to the nearest safe version, linking each pull request to its related security alert.
This task reduces exposure to OWASP CI/CD-SEC-3 (Dependency Chain Abuse) by continuously monitoring dependencies for disclosed vulnerabilities, and it implements NIST SSDF RV.1.1 (gather information from software acquirers, users, and public sources on potential vulnerabilities in the software and third-party components that the software uses, and investigate all credible reports). Complementary controls such as dependency review, approved package sources, and trusted publishing are still required to address malicious package insertion and dependency confusion.
Without automated dependency scanning, known vulnerabilities can remain in production long after patches are available. Manual tracking across hundreds of dependencies does not scale, and threat actors routinely scan for vulnerable library versions. Dependabot closes this gap by surfacing known risks when advisories are published and by providing immediate, reviewable remediation pull requests. Continuously monitoring dependencies for newly disclosed vulnerabilities reflects Assume breach, treating any third-party component as a potential liability that must be tracked and remediated rather than trusted indefinitely.