Summary

Dependabot Security Updates keep projects secure by opening pull requests that update dependencies to a non-vulnerable version. This extends Dependabot Security Updates to GitHub Enterprise Server (GHES) as a public beta. This release is targeting GitHub Enterprise Server 3.4.

Intended Outcome

Most projects use open source, and vulnerabilities in open source code are common. Dependabot helps to keep your projects updated and secure.

How will it work?

Today, Dependabot Security Updates automatically create a pull request in your repository to upgrade a vulnerable dependency to the minimum possible secure version needed to avoid the vulnerability. This is an automated action corresponding to Dependabot Alerts in your repository, for repositories where Dependency Graph is enabled.