{"id":43707,"date":"2022-08-11T16:18:52","date_gmt":"2022-08-11T15:18:52","guid":{"rendered":"https:\/\/www.developer-tech.com\/?p=43707"},"modified":"2022-08-11T16:18:57","modified_gmt":"2022-08-11T15:18:57","slug":"github-sends-dependabot-alerts-vulnerable-actions","status":"publish","type":"post","link":"https:\/\/www.developer-tech.com\/news\/2022\/aug\/11\/github-sends-dependabot-alerts-vulnerable-actions\/","title":{"rendered":"GitHub now sends Dependabot alerts for vulnerable Actions"},"content":{"rendered":"\n

GitHub<\/a> has announced that it will begin sending Dependabot<\/a> alerts when it detects vulnerable GitHub Actions<\/a>.<\/p>\n\n\n\n

GitHub Actions makes it easy for developers to automate their workflows. Dependabot, meanwhile, automatically updates dependencies to keep your projects secure.<\/p>\n\n\n\n

When an Action vulnerability is discovered, GitHub\u2019s team of security researchers will create an advisory to document it. Following the creation of an advisory, Dependabot alerts will be sent to impacted repositories.<\/p>\n\n\n\n

\u201cImprovements like these strengthen GitHub and our users\u2019 security posture, which is why we continue to invest in tightening connection points between GitHub\u2019s supply chain security solutions and GitHub Actions to improve the security of our builds,\u201d explained GitHub in a blog post<\/a>.<\/p>\n\n\n\n

Anyone already using Dependabot will start receiving the new alerts. If you\u2019re yet to start using the feature, you can enable Dependabot by selecting \u2018Enable all\u2019 under the \u2018Code security and analysis\u2019 tab.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

If you own a GitHub Action and have discovered a vulnerability, an advisory can be created from the security tab in your repo. GitHub\u2019s team will review the advisory and then issue it globally if required.<\/p>\n\n\n\n

(Photo by\u00a0Marcel Eberle<\/a>\u00a0on\u00a0Unsplash<\/a>)<\/em><\/p>\n\n\n\n

\"\"\/<\/a><\/figure>\n\n\n\n

Looking to revamp your digital transformation strategy?<\/strong> Learn more about Digital Transformation Week<\/a> taking place in Amsterdam, California, and London, and discover key strategies for making your digital efforts a success.<\/p>\n","protected":false},"excerpt":{"rendered":"

GitHub has announced that it will begin sending Dependabot alerts when it detects vulnerable GitHub Actions. GitHub Actions makes it easy for developers to automate their workflows. Dependabot, meanwhile, automatically updates dependencies to keep your projects secure. When an Action vulnerability is discovered, GitHub\u2019s team of security researchers will create an advisory to document it.… Read more »<\/a><\/p>\n","protected":false},"author":1570,"featured_media":43710,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[42,23],"tags":[1077,317,1395,246,143,738,219],"ppma_author":[1565],"acf":[],"yoast_head":"\nGitHub now sends Dependabot alerts for vulnerable Actions<\/title>\n<meta name=\"description\" content=\"GitHub has announced that it will begin sending Dependabot alerts when it detects vulnerable GitHub Actions.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.developer-tech.com\/news\/2022\/aug\/11\/github-sends-dependabot-alerts-vulnerable-actions\/\" \/>\n<meta property=\"og:locale\" content=\"en_GB\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"GitHub now sends Dependabot alerts for vulnerable Actions\" \/>\n<meta property=\"og:description\" content=\"GitHub has announced that it will begin sending Dependabot alerts when it detects vulnerable GitHub Actions.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.developer-tech.com\/news\/2022\/aug\/11\/github-sends-dependabot-alerts-vulnerable-actions\/\" \/>\n<meta property=\"og:site_name\" content=\"Developer Tech News\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/DeveloperTech\/\" \/>\n<meta property=\"article:published_time\" content=\"2022-08-11T15:18:52+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2022-08-11T15:18:57+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.developer-tech.com\/wp-content\/uploads\/sites\/3\/2022\/08\/github-actions-dependabot-cyber-security-cybersecurity.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"2400\" \/>\n\t<meta property=\"og:image:height\" content=\"1607\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Ryan Daws\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@Gadget_Ry\" \/>\n<meta name=\"twitter:site\" content=\"@Developer_Tech\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Ryan Daws\" \/>\n\t<meta name=\"twitter:label2\" content=\"Estimated reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.developer-tech.com\/news\/2022\/aug\/11\/github-sends-dependabot-alerts-vulnerable-actions\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.developer-tech.com\/news\/2022\/aug\/11\/github-sends-dependabot-alerts-vulnerable-actions\/\"},\"author\":{\"name\":\"Ryan Daws\",\"@id\":\"https:\/\/www.developer-tech.com\/#\/schema\/person\/e19481af1f321904940be911b4ca311e\"},\"headline\":\"GitHub now sends Dependabot alerts for vulnerable Actions\",\"datePublished\":\"2022-08-11T15:18:52+00:00\",\"dateModified\":\"2022-08-11T15:18:57+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.developer-tech.com\/news\/2022\/aug\/11\/github-sends-dependabot-alerts-vulnerable-actions\/\"},\"wordCount\":230,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/www.developer-tech.com\/#organization\"},\"keywords\":[\"cyber security\",\"cybersecurity\",\"dependabot\",\"git\",\"github\",\"GitHub actions\",\"security\"],\"articleSection\":[\"Git\",\"Hacking & Security\"],\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.developer-tech.com\/news\/2022\/aug\/11\/github-sends-dependabot-alerts-vulnerable-actions\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.developer-tech.com\/news\/2022\/aug\/11\/github-sends-dependabot-alerts-vulnerable-actions\/\",\"url\":\"https:\/\/www.developer-tech.com\/news\/2022\/aug\/11\/github-sends-dependabot-alerts-vulnerable-actions\/\",\"name\":\"GitHub now sends Dependabot alerts for vulnerable Actions\",\"isPartOf\":{\"@id\":\"https:\/\/www.developer-tech.com\/#website\"},\"datePublished\":\"2022-08-11T15:18:52+00:00\",\"dateModified\":\"2022-08-11T15:18:57+00:00\",\"description\":\"GitHub has announced that it will begin sending Dependabot alerts when it detects vulnerable GitHub Actions.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.developer-tech.com\/news\/2022\/aug\/11\/github-sends-dependabot-alerts-vulnerable-actions\/#breadcrumb\"},\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.developer-tech.com\/news\/2022\/aug\/11\/github-sends-dependabot-alerts-vulnerable-actions\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.developer-tech.com\/news\/2022\/aug\/11\/github-sends-dependabot-alerts-vulnerable-actions\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.developer-tech.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"GitHub now sends Dependabot alerts for vulnerable Actions\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.developer-tech.com\/#website\",\"url\":\"https:\/\/www.developer-tech.com\/\",\"name\":\"Developer Tech News\",\"description\":\"Gaming, Apps, HTML5, Java, PHP, C#, .net, IOT\",\"publisher\":{\"@id\":\"https:\/\/www.developer-tech.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.developer-tech.com\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-GB\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.developer-tech.com\/#organization\",\"name\":\"Developer Tech News\",\"url\":\"https:\/\/www.developer-tech.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\/\/www.developer-tech.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.developer-tech.com\/wp-content\/uploads\/sites\/3\/2020\/03\/developer-tech.png\",\"contentUrl\":\"https:\/\/www.developer-tech.com\/wp-content\/uploads\/sites\/3\/2020\/03\/developer-tech.png\",\"width\":455,\"height\":70,\"caption\":\"Developer Tech News\"},\"image\":{\"@id\":\"https:\/\/www.developer-tech.com\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/DeveloperTech\/\",\"https:\/\/twitter.com\/Developer_Tech\",\"https:\/\/www.linkedin.com\/groups\/54723\/\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.developer-tech.com\/#\/schema\/person\/e19481af1f321904940be911b4ca311e\",\"name\":\"Ryan Daws\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\/\/www.developer-tech.com\/#\/schema\/person\/image\/0a89168c3b9fc190f9bdbce571d2fa5f\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/b8c5d238e1fddd55d8a0064f1a534ba5?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/b8c5d238e1fddd55d8a0064f1a534ba5?s=96&d=mm&r=g\",\"caption\":\"Ryan Daws\"},\"description\":\"Ryan is a senior editor at TechForge Media with over a decade of experience covering the latest technology and interviewing leading industry figures. He can often be sighted at tech conferences with a strong coffee in one hand and a laptop in the other. If it's geeky, he\u2019s probably into it. Find him on Twitter (@Gadget_Ry) or Mastodon (@gadgetry@techhub.social)\",\"sameAs\":[\"https:\/\/twitter.com\/Gadget_Ry\"],\"url\":\"https:\/\/www.developer-tech.com\/news\/author\/ryan\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"GitHub now sends Dependabot alerts for vulnerable Actions","description":"GitHub has announced that it will begin sending Dependabot alerts when it detects vulnerable GitHub Actions.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.developer-tech.com\/news\/2022\/aug\/11\/github-sends-dependabot-alerts-vulnerable-actions\/","og_locale":"en_GB","og_type":"article","og_title":"GitHub now sends Dependabot alerts for vulnerable Actions","og_description":"GitHub has announced that it will begin sending Dependabot alerts when it detects vulnerable GitHub Actions.","og_url":"https:\/\/www.developer-tech.com\/news\/2022\/aug\/11\/github-sends-dependabot-alerts-vulnerable-actions\/","og_site_name":"Developer Tech News","article_publisher":"https:\/\/www.facebook.com\/DeveloperTech\/","article_published_time":"2022-08-11T15:18:52+00:00","article_modified_time":"2022-08-11T15:18:57+00:00","og_image":[{"width":2400,"height":1607,"url":"https:\/\/www.developer-tech.com\/wp-content\/uploads\/sites\/3\/2022\/08\/github-actions-dependabot-cyber-security-cybersecurity.jpg","type":"image\/jpeg"}],"author":"Ryan Daws","twitter_card":"summary_large_image","twitter_creator":"@Gadget_Ry","twitter_site":"@Developer_Tech","twitter_misc":{"Written by":"Ryan Daws","Estimated reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.developer-tech.com\/news\/2022\/aug\/11\/github-sends-dependabot-alerts-vulnerable-actions\/#article","isPartOf":{"@id":"https:\/\/www.developer-tech.com\/news\/2022\/aug\/11\/github-sends-dependabot-alerts-vulnerable-actions\/"},"author":{"name":"Ryan Daws","@id":"https:\/\/www.developer-tech.com\/#\/schema\/person\/e19481af1f321904940be911b4ca311e"},"headline":"GitHub now sends Dependabot alerts for vulnerable Actions","datePublished":"2022-08-11T15:18:52+00:00","dateModified":"2022-08-11T15:18:57+00:00","mainEntityOfPage":{"@id":"https:\/\/www.developer-tech.com\/news\/2022\/aug\/11\/github-sends-dependabot-alerts-vulnerable-actions\/"},"wordCount":230,"commentCount":0,"publisher":{"@id":"https:\/\/www.developer-tech.com\/#organization"},"keywords":["cyber security","cybersecurity","dependabot","git","github","GitHub actions","security"],"articleSection":["Git","Hacking & Security"],"inLanguage":"en-GB","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.developer-tech.com\/news\/2022\/aug\/11\/github-sends-dependabot-alerts-vulnerable-actions\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.developer-tech.com\/news\/2022\/aug\/11\/github-sends-dependabot-alerts-vulnerable-actions\/","url":"https:\/\/www.developer-tech.com\/news\/2022\/aug\/11\/github-sends-dependabot-alerts-vulnerable-actions\/","name":"GitHub now sends Dependabot alerts for vulnerable Actions","isPartOf":{"@id":"https:\/\/www.developer-tech.com\/#website"},"datePublished":"2022-08-11T15:18:52+00:00","dateModified":"2022-08-11T15:18:57+00:00","description":"GitHub has announced that it will begin sending Dependabot alerts when it detects vulnerable GitHub Actions.","breadcrumb":{"@id":"https:\/\/www.developer-tech.com\/news\/2022\/aug\/11\/github-sends-dependabot-alerts-vulnerable-actions\/#breadcrumb"},"inLanguage":"en-GB","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.developer-tech.com\/news\/2022\/aug\/11\/github-sends-dependabot-alerts-vulnerable-actions\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.developer-tech.com\/news\/2022\/aug\/11\/github-sends-dependabot-alerts-vulnerable-actions\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.developer-tech.com\/"},{"@type":"ListItem","position":2,"name":"GitHub now sends Dependabot alerts for vulnerable Actions"}]},{"@type":"WebSite","@id":"https:\/\/www.developer-tech.com\/#website","url":"https:\/\/www.developer-tech.com\/","name":"Developer Tech News","description":"Gaming, Apps, HTML5, Java, PHP, C#, .net, IOT","publisher":{"@id":"https:\/\/www.developer-tech.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.developer-tech.com\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-GB"},{"@type":"Organization","@id":"https:\/\/www.developer-tech.com\/#organization","name":"Developer Tech News","url":"https:\/\/www.developer-tech.com\/","logo":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/www.developer-tech.com\/#\/schema\/logo\/image\/","url":"https:\/\/www.developer-tech.com\/wp-content\/uploads\/sites\/3\/2020\/03\/developer-tech.png","contentUrl":"https:\/\/www.developer-tech.com\/wp-content\/uploads\/sites\/3\/2020\/03\/developer-tech.png","width":455,"height":70,"caption":"Developer Tech News"},"image":{"@id":"https:\/\/www.developer-tech.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/DeveloperTech\/","https:\/\/twitter.com\/Developer_Tech","https:\/\/www.linkedin.com\/groups\/54723\/"]},{"@type":"Person","@id":"https:\/\/www.developer-tech.com\/#\/schema\/person\/e19481af1f321904940be911b4ca311e","name":"Ryan Daws","image":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/www.developer-tech.com\/#\/schema\/person\/image\/0a89168c3b9fc190f9bdbce571d2fa5f","url":"https:\/\/secure.gravatar.com\/avatar\/b8c5d238e1fddd55d8a0064f1a534ba5?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/b8c5d238e1fddd55d8a0064f1a534ba5?s=96&d=mm&r=g","caption":"Ryan Daws"},"description":"Ryan is a senior editor at TechForge Media with over a decade of experience covering the latest technology and interviewing leading industry figures. He can often be sighted at tech conferences with a strong coffee in one hand and a laptop in the other. If it's geeky, he\u2019s probably into it. Find him on Twitter (@Gadget_Ry) or Mastodon (@gadgetry@techhub.social)","sameAs":["https:\/\/twitter.com\/Gadget_Ry"],"url":"https:\/\/www.developer-tech.com\/news\/author\/ryan\/"}]}},"authors":[{"term_id":1565,"user_id":1570,"is_guest":0,"slug":"ryan","display_name":"Ryan Daws","avatar_url":"https:\/\/secure.gravatar.com\/avatar\/b8c5d238e1fddd55d8a0064f1a534ba5?s=96&d=mm&r=g","user_url":"","last_name":"Daws","first_name":"Ryan","description":"Ryan is a senior editor at TechForge Media with over a decade of experience covering the latest technology and interviewing leading industry figures. He can often be sighted at tech conferences with a strong coffee in one hand and a laptop in the other. If it's geeky, he\u2019s probably into it. Find him on Twitter (@Gadget_Ry) or Mastodon (@gadgetry@techhub.social)"}],"_links":{"self":[{"href":"https:\/\/www.developer-tech.com\/wp-json\/wp\/v2\/posts\/43707"}],"collection":[{"href":"https:\/\/www.developer-tech.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.developer-tech.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.developer-tech.com\/wp-json\/wp\/v2\/users\/1570"}],"replies":[{"embeddable":true,"href":"https:\/\/www.developer-tech.com\/wp-json\/wp\/v2\/comments?post=43707"}],"version-history":[{"count":0,"href":"https:\/\/www.developer-tech.com\/wp-json\/wp\/v2\/posts\/43707\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.developer-tech.com\/wp-json\/wp\/v2\/media\/43710"}],"wp:attachment":[{"href":"https:\/\/www.developer-tech.com\/wp-json\/wp\/v2\/media?parent=43707"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.developer-tech.com\/wp-json\/wp\/v2\/categories?post=43707"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.developer-tech.com\/wp-json\/wp\/v2\/tags?post=43707"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.developer-tech.com\/wp-json\/wp\/v2\/ppma_author?post=43707"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}