Dependabot, GitHub’s renowned security feature, has been consistently evolving to make software dependency management more efficient and secure. Recent improvements include pausing pull requests on inactive repositories and enhancing the visibility of alerts to developers. In a bid to tackle alert fatigue caused by false positive alerts, Dependabot has now introduced an auto-dismissal function.
False positive alerts are those that, though identified as potential security threats, are unlikely to be exploitable and may only have limited effects. As Erin Havens, Senior Product Manager at GitHub, explains, GitHub adopts an innovative approach to identifying false positives by employing a contextual alert rules engine that utilizes a rich set of complex metadata.
In a significant move, Dependabot has announced the public beta release of this auto-dismissal function, which specifically targets npm devDependencies, a common source of false positive alerts. Dependabot now evaluates incoming alerts against GitHub-curated rules, factoring in the usage of npm devDependencies and their associated risk levels. Harry Marr, Senior Director of Software Engineering for GitHub supply chain security, states that auto-dismissing false positives has led to a reduction in the volume of npm alerts by approximately 15%.
The auto-dismissal function works seamlessly and is enabled by default for public repositories. Administrators of private repositories can also activate this feature on the Code Security page. Dependabot automatically dismisses false positive alerts and notifies users through a special timeline event, audit log, webhook, REST, GraphQL, and alert-centric views. To review auto-dismissed alerts, users can apply the resolution:auto-dismissed filter.
Dependabot’s commitment to enhancing security and reducing alert fatigue doesn’t end here. The upcoming roadmap includes support for additional ecosystems, as Dependabot invites users to share their feedback and ideas in the GitHub Community. To learn more about alert rules and other aspects of this feature, you can refer to the dedicated changelog, FAQ, and documentation.
In summary, Dependabot’s new auto-dismissal function equips developers with a more streamlined and efficient approach to managing security alerts. By addressing the issue of alert fatigue caused by false positives, Dependabot continues to play a crucial role in improving security while ensuring a smooth experience for developers.
Up until working with Casey, we had only had poor to mediocre experiences outsourcing work to agencies. Casey & the team at CJ&CO are the exception to the rule.
Communication was beyond great, his understanding of our vision was phenomenal, and instead of needing babysitting like the other agencies we worked with, he was not only completely dependable but also gave us sound suggestions on how to get better results, at the risk of us not needing him for the initial job we requested (absolute gem).
This has truly been the first time we worked with someone outside of our business that quickly grasped our vision, and that I could completely forget about and would still deliver above expectations.
I honestly can't wait to work in many more projects together!
![The ‘Giveaway Piggy Back Scam’ In Full Swing [2022]](https://www.cjco.com.au/wp-content/uploads/pexels-nataliya-vaitkevich-7172791-1-scaled-2-683x1024.jpg)
Disclaimer
*The information this blog provides is for general informational purposes only and is not intended as financial or professional advice. The information may not reflect current developments and may be changed or updated without notice. Any opinions expressed on this blog are the author’s own and do not necessarily reflect the views of the author’s employer or any other organization. You should not act or rely on any information contained in this blog without first seeking the advice of a professional. No representation or warranty, express or implied, is made as to the accuracy or completeness of the information contained in this blog. The author and affiliated parties assume no liability for any errors or omissions.
