🔰 What Is GitHub Dependabot?
GitHub Dependabot scans the package dependencies of the projects in your repository and checks whether any of those packages have known vulnerabilities. When it finds one, it can notify you by email or other means. It can also create a pull request that updates the package for you.
It supports many kinds of package files, such as package.json in Node.js projects and .csproj files in .NET projects.
With this feature, you can learn about security risks and respond to them quickly, without relying on manual work.
🛠️ How to Enable Dependabot Alerts
Among the Dependabot features, vulnerability alerts are the notifications you get when your project depends on a package with a known vulnerability. They should be enabled by default when you create a repository on GitHub.
To check the settings, open the "Settings" page of the repository and click "Advanced security" in the "Security and quality" section. The settings for "Dependency Scanning" and "Dependabot" appear there.
If Dependency Scanning > Dependency graph is On, and Dependabot > Dependabot alerts is also On, you will be notified automatically whenever a package that your projects depend on is found to have a vulnerability.
🤔 Packages Have Transitive Dependencies
In the package management systems of many programming languages, a package that your project depends on may itself depend on other packages. These are called transitive dependencies. For example, say your project directly depends on package A, and package A depends on package B. Then your project indirectly depends on package B.
In a Node.js project, the package-lock.json file contains not only the packages you depend on directly, but also the ones you depend on transitively. So vulnerabilities in indirect dependencies can be detected too.
😱 .NET Projects Cannot Detect Transitive Vulnerabilities Out of the Box
In a .NET project, Dependabot reads the packages (NuGet packages) written directly in the .csproj file, and it checks those packages for vulnerabilities. But by default, it does not check the transitive dependencies, which are the packages that those packages depend on.
By the way, .NET also lets you create and use a lock file for NuGet package references (packages.lock.json). But this does not seem to be common. In my experience, I have never seen anyone use it.
Maybe that is related, but I'm not sure. In any case, when I tried it myself, Dependabot did not seem to read packages.lock.json, even when the file existed in the repository.
💡 How to Detect Transitive Vulnerabilities in .NET Projects
So how can you detect vulnerabilities in the transitive dependencies of a .NET project? You need to enable an option named "Automatic dependency submission". It is disabled by default, so you have to turn it on yourself. You can find it on the same repository settings page I described earlier.
This option does more than a static analysis of the project files and lock files in your repository. It actually restores the packages of the .NET project, and it uses the resulting transitive dependency information to detect vulnerabilities.
So I think you practically need to enable this option to make Dependabot alerts meaningful in a typical .NET project.
💸 Why Is It Disabled by Default?
This is only my guess. Restoring packages is more than a static analysis, so it uses GitHub Actions run time. I think that is the reason.
As far as I read the official documentation, Dependabot alerts do not seem to be billed, even for private repositories. However, Automatic dependency submission seems to be billed separately. The docs say it counts toward your GitHub Actions minutes.
🎉 Summary
Dependabot automatically notifies you when a package used by a project in your repository has a known vulnerability. It is an essential feature today.
However, in a .NET project, the default settings detect vulnerabilities only in directly referenced packages. They do not detect vulnerabilities in transitive dependencies.
So in a .NET project, I recommend enabling the "Automatic dependency submission" option on the repository settings page. Please note that it uses GitHub Actions run time, and any usage beyond the free quota is billed.
🔍 References
These are the related pages in the official GitHub documentation.
- About Dependabot alerts (an overview of Dependabot alerts and when they are triggered)
- About the dependency graph (an overview of the dependency graph, which is built by analyzing manifest files and lock files)
- Dependency graph supported package ecosystems (the supported files and the way transitive dependencies are detected for each ecosystem, including the difference between npm and NuGet)
- How the dependency graph recognizes dependencies (explains Automatic dependency submission and Dependabot graph jobs, and says that the former counts toward your GitHub Actions minutes)
- Configuring automatic dependency submission for your repository (the setup steps and prerequisites)
- Dependabot supported ecosystems and repositories (the ecosystems supported by Dependabot version updates and security updates, including NuGet)
- About billing for GitHub Actions (how GitHub Actions is billed)
- Dependency auto-submission now supports Gradle (GitHub Changelog) (notes that turning on this feature will incur Actions usage)
❤️ Happy coding! If you have any updates or findings of your own, feel free to share them in the comments! 👇
Top comments (2)
tr.ee/dev-to
dependabot skips transitive packages that aren't pinned in the lockfile, so you still need a separate dotnet‑list‑package‑vulnerable step in CI to avoid a false sense of safety