What's changed: New GH-500 Chapter 3 (dependency risk = dependency graph [direct/transitive], SBOM [SPDX/CycloneDX] export, Dependabot alerts/security updates [auto PRs]/version updates, CVSS+EPSS prioritization; Dependency Review & policies = pre-merge gate/license validation, grouping/auto-dismiss/dependabot.yml update strategy, permissions/roles/workflows, webhooks/integrations)
3.1Managing Dependency Risk — Dependency Graph, SBOM, and Dependabot
Understand generating/interpreting the dependency graph, SBOM usage/formats/export, Dependabot vulnerability alerts and security updates, EPSS-based prioritization, and remediation via campaigns and pull requests.
Modern software rests on many open-source dependencies, whose vulnerabilities become your app’s vulnerabilities. Supply chain security (the area bundling the dependency graph/Dependabot/Dependency Review; paid features are part of Code Security) visualizes "what dependencies you have," detects "whether any have known vulnerabilities," and assists "updating to safe versions."
3.1.1Dependency graph and SBOM
The dependency graph is a list of direct and transitive dependencies parsed from manifests/lockfiles (package-lock.json, requirements.txt). Vulnerability detection runs on top of it. An SBOM (Software Bill of Materials) is a "bill of materials for software," listing included dependencies and versions in standard formats (SPDX, CycloneDX). GitHub can export an SBOM from the dependency graph, used for compliance and supply-chain transparency.
3.1.2Dependabot alerts and security updates
Dependabot alerts notify when a dependency has a known vulnerability (a CVE in the GitHub Advisory Database). Dependabot security updates auto-create pull requests to bump vulnerable dependencies to safe versions. Dependabot version updates additionally keep dependencies current regularly regardless of vulnerabilities. Remediation is basically "merge a PR that updates to a safe version," running tests to confirm behavior.
3.1.3Prioritization with EPSS
Vulnerabilities are numerous and can’t all be fixed at once. For prioritization, beyond severity (CVSS), EPSS (Exploit Prediction Scoring System) helps. EPSS estimates the probability a vulnerability is actually exploited; combined with CVSS (severity), you fix "severe and likely-exploited" ones first. This directs limited resources by highest risk.
Common: (1) Dependency graph = parses direct/transitive deps from manifests/lockfiles → basis for vuln detection. (2) SBOM = bill of materials (SPDX/CycloneDX), exportable for transparency/compliance. (3) Dependabot alerts (known vulns = Advisory/CVE) + security updates (auto PRs) + version updates (regular currency). (4) Prioritize via CVSS (severity) + EPSS (exploit probability); remediate with a PR to a safe version.
Watch out: (1) Dependabot security updates (vuln-driven, to safe versions) vs version updates (currency regardless of vulns) are different. (2) Transitive dependency vulnerabilities count too—don’t look only at direct deps. (3) EPSS (exploit probability) and CVSS (severity) are different metrics—combine them. (4) An SBOM is a "bill of materials," not a vulnerability list (detection is via Dependabot/Advisory).
3.1.4Section summary
- Dependency graph = direct/transitive deps (basis for detection); SBOM = bill of materials (SPDX/CycloneDX), exportable
- Dependabot: alerts (known vulns) + security updates (auto PRs) + version updates (regular currency)
- Prioritize via CVSS (severity) + EPSS (exploit probability); remediate by merging a tested PR to a safe version
- Security updates ≠ version updates; transitive dependencies count too
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. Which parses direct/transitive deps from manifests/lockfiles and is the basis for vulnerability detection?
Q2. Which auto-creates pull requests to bump vulnerable dependencies to safe versions?
Q3. For compliance/transparency, what lists included dependencies and versions in standard formats (SPDX/CycloneDX)?
Q4. Among many vuln alerts, which metric represents the "probability of actual exploitation" for prioritization?
Q5. Which correctly distinguishes Dependabot security updates from version updates?
Q6. Direct dependencies have no vulnerabilities, yet a Dependabot alert appeared. Correct understanding?