diff --git a/.github/allowed-actions.js b/.github/allowed-actions.js index 292d590565..8f08371ea1 100644 --- a/.github/allowed-actions.js +++ b/.github/allowed-actions.js @@ -31,7 +31,7 @@ module.exports = [ 'rachmari/actions-add-new-issue-to-column@1a459ef92308ba7c9c9dc2fcdd72f232495574a9', 'rachmari/labeler@832d42ec5523f3c6d46e8168de71cd54363e3e2e', 'repo-sync/github-sync@3832fe8e2be32372e1b3970bbae8e7079edeec88', - 'repo-sync/pull-request@58af525d19d3c2b4f744d3348c6823b6340a4921', + 'repo-sync/pull-request@33777245b1aace1a58c87a29c90321aa7a74bd7d', 'rtCamp/action-slack-notify@e17352feaf9aee300bf0ebc1dfbf467d80438815', 'tjenkinson/gh-action-auto-merge-dependency-updates@cee2ac0' ] diff --git a/.github/workflows/repo-sync.yml b/.github/workflows/repo-sync.yml index daf0f939bb..ae0c9514af 100644 --- a/.github/workflows/repo-sync.yml +++ b/.github/workflows/repo-sync.yml @@ -45,7 +45,7 @@ jobs: github_token: ${{ secrets.OCTOMERGER_PAT_WITH_REPO_AND_WORKFLOW_SCOPE }} - name: Create pull request - uses: repo-sync/pull-request@58af525d19d3c2b4f744d3348c6823b6340a4921 + uses: repo-sync/pull-request@33777245b1aace1a58c87a29c90321aa7a74bd7d env: GITHUB_TOKEN: ${{ secrets.OCTOMERGER_PAT_WITH_REPO_AND_WORKFLOW_SCOPE }} with: diff --git a/assets/images/help/dependabot/dependabot-alert-pr-link.png b/assets/images/help/dependabot/dependabot-alert-pr-link.png new file mode 100644 index 0000000000..03c9de0402 Binary files /dev/null and b/assets/images/help/dependabot/dependabot-alert-pr-link.png differ diff --git a/assets/images/help/dependabot/dependabot-security-update-error.png b/assets/images/help/dependabot/dependabot-security-update-error.png new file mode 100644 index 0000000000..5b990062bf Binary files /dev/null and b/assets/images/help/dependabot/dependabot-security-update-error.png differ diff --git a/assets/images/help/dependabot/dependabot-tab-view-error-beta.png b/assets/images/help/dependabot/dependabot-tab-view-error-beta.png new file mode 100644 index 0000000000..2b7d81a0f0 Binary files /dev/null and b/assets/images/help/dependabot/dependabot-tab-view-error-beta.png differ diff --git a/assets/images/help/dependabot/dependabot-version-update-error-beta.png b/assets/images/help/dependabot/dependabot-version-update-error-beta.png new file mode 100644 index 0000000000..656afdc470 Binary files /dev/null and b/assets/images/help/dependabot/dependabot-version-update-error-beta.png differ diff --git a/content/github/administering-a-repository/about-github-dependabot-version-updates.md b/content/github/administering-a-repository/about-github-dependabot-version-updates.md index 167fff0c42..d765f55cfb 100644 --- a/content/github/administering-a-repository/about-github-dependabot-version-updates.md +++ b/content/github/administering-a-repository/about-github-dependabot-version-updates.md @@ -17,7 +17,7 @@ You enable {% data variables.product.prodname_dependabot_version_updates %} by c When {% data variables.product.prodname_dependabot_short %} identifies an outdated dependency, it raises a pull request to update the manifest to the latest version of the dependency. For vendored dependencies, {% data variables.product.prodname_dependabot_short %} raises a pull request to directly replace the outdated dependency with the new version. You check that your tests pass, review the changelog and release notes included in the pull request summary, and then merge it. For more information, see "[Enabling and disabling version updates](/github/administering-a-repository/enabling-and-disabling-version-updates)." -If you enable security updates, {% data variables.product.prodname_dependabot %} also raises pull requests to update vulnerable dependencies. For more information, see "[Configuring {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/configuring-github-dependabot-security-updates)." +If you enable security updates, {% data variables.product.prodname_dependabot %} also raises pull requests to update vulnerable dependencies. For more information, see "[About {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/about-github-dependabot-security-updates)." {% data reusables.dependabot.dependabot-tos %} diff --git a/content/github/administering-a-repository/about-securing-your-repository.md b/content/github/administering-a-repository/about-securing-your-repository.md index dcce1ad09e..63214df232 100644 --- a/content/github/administering-a-repository/about-securing-your-repository.md +++ b/content/github/administering-a-repository/about-securing-your-repository.md @@ -21,10 +21,14 @@ The first step to securing a repository is to set up who can see and modify your Privately discuss and fix security vulnerabilities in your repository's code. You can then publish a security advisory to alert your community to the vulnerability and encourage them to upgrade. For more information, see "[About {% data variables.product.prodname_security_advisories %}](/github/managing-security-vulnerabilities/about-github-security-advisories)." -- **{% data variables.product.prodname_dependabot_short %} alerts** +- **{% data variables.product.prodname_dependabot_short %} alerts and security updates** - View alerts about dependencies that are known to contain security vulnerabilities, and choose whether to have pull requests generated automatically to update these dependencies. For more information, see "[Viewing and updating vulnerable dependencies in your repository](/github/managing-security-vulnerabilities/viewing-and-updating-vulnerable-dependencies-in-your-repository)" - and "[Configuring {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/configuring-github-dependabot-security-updates)." + View alerts about dependencies that are known to contain security vulnerabilities, and choose whether to have pull requests generated automatically to update these dependencies. For more information, see "[About alerts for vulnerable dependencies](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)" + and "[About {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/about-github-dependabot-security-updates)." + +- **{% data variables.product.prodname_dependabot_short %} version updates** + + Use {% data variables.product.prodname_dependabot %} to automatically raise pull requests to keep your dependencies up-to-date. This helps reduce your exposure to older versions of dependencies. Using newer versions makes it easier to apply patches if security vulnerabilities are discovered, and also makes it easier for {% data variables.product.prodname_dependabot_security_updates %} to successfully raise pull requests to upgrade vulnerable dependencies. For more information, see "[About {% data variables.product.prodname_dependabot_version_updates %}](/github/administering-a-repository/about-github-dependabot-version-updates)." - **{% data variables.product.prodname_code_scanning_capc %} alerts** diff --git a/content/github/administering-a-repository/managing-pull-requests-for-dependency-updates.md b/content/github/administering-a-repository/managing-pull-requests-for-dependency-updates.md index d59bf97cc3..6f93905e1f 100644 --- a/content/github/administering-a-repository/managing-pull-requests-for-dependency-updates.md +++ b/content/github/administering-a-repository/managing-pull-requests-for-dependency-updates.md @@ -9,9 +9,9 @@ versions: ### About {% data variables.product.prodname_dependabot %} pull requests -{% data variables.product.prodname_dependabot %} raises pull requests to update dependencies. Depending on how your repository is configured, {% data variables.product.prodname_dependabot_short %} may raise pull requests for version updates and/or for security updates. You manage these pull requests in the same way as any other pull request, but there are also some extra commands available. For information about enabling {% data variables.product.prodname_dependabot %} dependency updates, see "[Configuring {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/configuring-github-dependabot-security-updates)" and "[Enabling and disabling version updates](/github/administering-a-repository/enabling-and-disabling-version-updates)." +{% data reusables.dependabot.pull-request-introduction %} -When {% data variables.product.prodname_dependabot %} raises a pull request, you're notified by your chosen method for the repository. Each pull request contains detailed information about the proposed change, taken from the package management system. These pull requests follow the normal checks and tests defined in your repository. In addition, where enough information is available, you'll see a compatibility score. This may also help you decide whether or not to merge the change. For information about this score, see "[Configuring {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/configuring-github-dependabot-security-updates)." +When {% data variables.product.prodname_dependabot %} raises a pull request, you're notified by your chosen method for the repository. Each pull request contains detailed information about the proposed change, taken from the package manager. These pull requests follow the normal checks and tests defined in your repository. In addition, where enough information is available, you'll see a compatibility score. This may also help you decide whether or not to merge the change. For information about this score, see "[About {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/about-github-dependabot-security-updates)." If you have many dependencies to manage, you may want to customize the configuration for each package manager so that pull requests have specific reviewers, assignees, and labels. For more information, see "[Customizing dependency updates](/github/administering-a-repository/customizing-dependency-updates)." diff --git a/content/github/authenticating-to-github/githubs-ssh-key-fingerprints.md b/content/github/authenticating-to-github/githubs-ssh-key-fingerprints.md index 007a22af6d..309b4e69c1 100644 --- a/content/github/authenticating-to-github/githubs-ssh-key-fingerprints.md +++ b/content/github/authenticating-to-github/githubs-ssh-key-fingerprints.md @@ -9,12 +9,7 @@ versions: free-pro-team: '*' --- -These are {% data variables.product.prodname_dotcom %}'s public key fingerprints (in hexadecimal format): - -- `16:27:ac:a5:76:28:2d:36:63:1b:56:4d:eb:df:a6:48` (RSA) -- `ad:1c:08:a4:40:e3:6f:9c:f5:66:26:5d:4b:33:5d:8c` (DSA) - -These are the SHA256 hashes shown in OpenSSH 6.8 and newer (in base64 format): +These are {% data variables.product.prodname_dotcom %}'s public key fingerprints: - `SHA256:nThbg6kXUpJWGl7E1IGOCspRomTxdCARLviKw6E5SY8` (RSA) - `SHA256:br9IjFspm1vxR3iA35FWE+4VTyz1hYVLIE2t1/CeyWQ` (DSA) diff --git a/content/github/authenticating-to-github/testing-your-ssh-connection.md b/content/github/authenticating-to-github/testing-your-ssh-connection.md index b70b2278b2..a1b6502337 100644 --- a/content/github/authenticating-to-github/testing-your-ssh-connection.md +++ b/content/github/authenticating-to-github/testing-your-ssh-connection.md @@ -24,14 +24,6 @@ When you test your connection, you'll need to authenticate this action using you You may see a warning like this: - ```shell - > The authenticity of host '{% data variables.command_line.codeblock %} (IP ADDRESS)' can't be established. - > RSA key fingerprint is 16:27:ac:a5:76:28:2d:36:63:1b:56:4d:eb:df:a6:48. - > Are you sure you want to continue connecting (yes/no)? - ``` - - or like this: - ```shell > The authenticity of host '{% data variables.command_line.codeblock %} (IP ADDRESS)' can't be established. > RSA key fingerprint is SHA256:nThbg6kXUpJWGl7E1IGOCspRomTxdCARLviKw6E5SY8. diff --git a/content/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning.md b/content/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning.md index af2300e7a3..0cc08d5b3c 100644 --- a/content/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning.md +++ b/content/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning.md @@ -48,7 +48,7 @@ By default, the {% data variables.product.prodname_codeql_workflow %} uses the ` #### Scanning pull requests -The default {% data variables.product.prodname_codeql_workflow %} uses the `pull_request` event to trigger a code scan on the `HEAD` commit of a pull request against the default branch. {% if currentVersion ver_gt "enterprise-server@2.21" %}The `pull_request` event is not triggered if the pull request was opened from a private fork.{% else %}If a pull request is from a private fork, the `pull_request` event will only be triggered if you've selected the "Run workflows from fork pull requests" option in the repository settings. For more information, see "[Disabling or limiting {% data variables.product.prodname_actions %} for a repository](/github/administering-a-repository/disabling-or-limiting-github-actions-for-a-repository#enabling-workflows-for-private-repository-forks)."{% endif %} +The default {% data variables.product.prodname_codeql_workflow %} uses the `pull_request` event to trigger a code scan on pull requests targeted against the default branch. {% if currentVersion ver_gt "enterprise-server@2.21" %}The `pull_request` event is not triggered if the pull request was opened from a private fork.{% else %}If a pull request is from a private fork, the `pull_request` event will only be triggered if you've selected the "Run workflows from fork pull requests" option in the repository settings. For more information, see "[Disabling or limiting {% data variables.product.prodname_actions %} for a repository](/github/administering-a-repository/disabling-or-limiting-github-actions-for-a-repository#enabling-workflows-for-private-repository-forks)."{% endif %} For more information about the `pull_request` event, see "[Workflow syntax for {% data variables.product.prodname_actions %}](/actions/reference/workflow-syntax-for-github-actions#onpushpull_requestbranchestags)." @@ -150,8 +150,6 @@ jobs: steps: - name: Checkout repository uses: actions/checkout@v2 - with: - fetch-depth: 2 - name: Set up Python uses: actions/setup-python@v2 with: @@ -165,8 +163,6 @@ jobs: # Set the `CODEQL-PYTHON` environment variable to the Python executable # that includes the dependencies echo "::set-env name=CODEQL_PYTHON::$(which python)" - - run: git checkout HEAD^2 - if: ${{ github.event_name == 'pull_request' }} - name: Initialize CodeQL uses: github/codeql-action/init@v1 with: diff --git a/content/github/finding-security-vulnerabilities-and-errors-in-your-code/enabling-code-scanning-for-a-repository.md b/content/github/finding-security-vulnerabilities-and-errors-in-your-code/enabling-code-scanning-for-a-repository.md index f4cabb2462..897fc3a74f 100644 --- a/content/github/finding-security-vulnerabilities-and-errors-in-your-code/enabling-code-scanning-for-a-repository.md +++ b/content/github/finding-security-vulnerabilities-and-errors-in-your-code/enabling-code-scanning-for-a-repository.md @@ -42,7 +42,7 @@ You decide how you generate {% data variables.product.prodname_code_scanning %} ![Choose where to commit](/assets/images/help/repository/start-commit-choose-where-to-commit.png) 8. Click **Commit new file** or **Propose new file**. -In the default {% data variables.product.prodname_codeql_workflow %}, {% data variables.product.prodname_code_scanning %} is configured to analyze your code each time you either push a change to the default branch or any protected branches, or raise a pull request against the default branch or any protected branches. As a result, {% data variables.product.prodname_code_scanning %} will now commence. +In the default {% data variables.product.prodname_codeql_workflow %}, {% data variables.product.prodname_code_scanning %} is configured to analyze your code each time you either push a change to the default branch or any protected branches, or raise a pull request against the default branch. As a result, {% data variables.product.prodname_code_scanning %} will now commence. ### Viewing the logging output from {% data variables.product.prodname_code_scanning %} @@ -90,7 +90,7 @@ After {% data variables.product.prodname_code_scanning %} has analyzed the code There are other situations where there may be no analysis for the latest commit to the base branch for a pull request. These include: -* The pull request has been raised against a branch other than the default branch or a protected branch, and this branch hasn't been analyzed. +* The pull request has been raised against a branch other than the default branch, and this branch hasn't been analyzed. To check whether a branch has been scanned, go to the {% data variables.product.prodname_code_scanning_capc %} page, click the **Branch** drop-down and select the relevant branch. diff --git a/content/github/finding-security-vulnerabilities-and-errors-in-your-code/managing-code-scanning-alerts-for-your-repository.md b/content/github/finding-security-vulnerabilities-and-errors-in-your-code/managing-code-scanning-alerts-for-your-repository.md index 1d48dd897e..d8dc845a31 100644 --- a/content/github/finding-security-vulnerabilities-and-errors-in-your-code/managing-code-scanning-alerts-for-your-repository.md +++ b/content/github/finding-security-vulnerabilities-and-errors-in-your-code/managing-code-scanning-alerts-for-your-repository.md @@ -1,7 +1,7 @@ --- title: Managing code scanning alerts for your repository shortTitle: Managing alerts -intro: 'You can view, fix, dismiss, or delete alerts for potential vulnerabilities or errors in your project''s code.' +intro: 'You can view, fix, {% if currentVersion == "enterprise-server@2.22" %}or close{% else %}dismiss, or delete{% endif %} alerts for potential vulnerabilities or errors in your project''s code.' product: '{% data reusables.gated-features.code-scanning %}' permissions: 'People with write permission to a repository can manage {% data variables.product.prodname_code_scanning %} alerts for the repository.' versions: @@ -28,7 +28,7 @@ Each alert highlights a problem with the code and the name of the tool that iden If you enable {% data variables.product.prodname_code_scanning %} using {% data variables.product.prodname_codeql %}, this can also detect data-flow problems in your code. Data-flow analysis finds potential security issues in code, such as: using data insecurely, passing dangerous arguments to functions, and leaking sensitive information. -When {% data variables.product.prodname_code_scanning_capc %} reports data-flow alerts, {% data variables.product.prodname_dotcom %} shows you how data moves through the code. {% data variables.product.prodname_code_scanning_capc %} allows you to identify the areas of your code that leak sensitive information, and that could be the entry point for attacks by malicious users. +When {% data variables.product.prodname_code_scanning %} reports data-flow alerts, {% data variables.product.prodname_dotcom %} shows you how data moves through the code. {% data variables.product.prodname_code_scanning_capc %} allows you to identify the areas of your code that leak sensitive information, and that could be the entry point for attacks by malicious users. ### Viewing an alert @@ -48,15 +48,23 @@ Anyone with read permission for a repository can see {% data variables.product.p Anyone with write permission for a repository can fix an alert by committing a correction to the code. If the repository has {% data variables.product.prodname_code_scanning %} scheduled to run on pull requests, it's best to raise a pull request with your correction. This will trigger {% data variables.product.prodname_code_scanning %} analysis of the changes and test that your fix doesn't introduce any new problems. For more information, see "[Configuring {% data variables.product.prodname_code_scanning %}](/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning)" and "[Triaging {% data variables.product.prodname_code_scanning %} alerts in pull requests](/github/finding-security-vulnerabilities-and-errors-in-your-code/triaging-code-scanning-alerts-in-pull-requests)." -If you have write permission for a repository, you can view fixed alerts by viewing the summary of alerts and clicking **Closed**. For more information, see "[Viewing an alert](#viewing-an-alert)." The "Closed" list shows fixed alerts and alerts that users have dismissed. +If you have write permission for a repository, you can view fixed alerts by viewing the summary of alerts and clicking **Closed**. For more information, see "[Viewing an alert](#viewing-an-alert)." The "Closed" list shows fixed alerts and alerts that users have {% if currentVersion == "enterprise-server@2.22" %}closed{% else %}dismissed{% endif %}. Alerts may be fixed in one branch but not in another. You can use the "Branch" drop-down menu, on the summary of alerts, to check whether an alert is fixed in a particular branch. ![Filtering alerts by branch](/assets/images/help/repository/code-scanning-branch-filter.png) +{% if currentVersion == "enterprise-server@2.22" %} + +### Closing an alert + +Closing an alert is a way to resolve an alert that you don't think needs to be fixed. {% data reusables.code-scanning.close-alert-examples %} + +{% else %} + ### Dismissing or deleting alerts -There are two ways of closing an alert. You can fix the problem in the code, or you can dismiss the alert. Alternatively, you can delete alerts. Deleting alerts is useful in situations where you have enabled a {% data variables.product.prodname_code_scanning %} tool and then decided to remove it, or where you have enabled {% data variables.product.prodname_codeql %} analysis with a larger set of queries than you want to continue using, and you've then removed some queries from the tool. In both cases, deleting alerts allows you to clean up your {% data variables.product.prodname_code_scanning %} results. You can delete alerts from the summary list within the **Security** tab. +There are two ways of closing an alert. You can fix the problem in the code, or you can dismiss the alert. Alternatively, if you have admin permissions for the repository, you can delete alerts. Deleting alerts is useful in situations where you have enabled a {% data variables.product.prodname_code_scanning %} tool and then decided to remove it, or where you have enabled {% data variables.product.prodname_codeql %} analysis with a larger set of queries than you want to continue using, and you've then removed some queries from the tool. In both cases, deleting alerts allows you to clean up your {% data variables.product.prodname_code_scanning %} results. You can delete alerts from the summary list within the **Security** tab. Dismissing an alert is a way of closing an alert that you don't think needs to be fixed. {% data reusables.code-scanning.close-alert-examples %} You can dismiss alerts from {% data variables.product.prodname_code_scanning %} annotations in code, or from the summary list within the **Security** tab. @@ -77,11 +85,21 @@ When you delete an alert: To dismiss or delete alerts: +{% endif %} + {% data reusables.repositories.navigate-to-repo %} {% data reusables.repositories.sidebar-security %} {% data reusables.repositories.sidebar-code-scanning-alerts %} +{% if currentVersion == "enterprise-server@2.22" %} +{% data reusables.code-scanning.click-alert-in-list %} +1. Select the **Close** drop-down menu and click a reason for closing the alert. + ![Choosing reason for closing the alert via the Close drop-down](/assets/images/help/repository/code-scanning-alert-close-drop-down.png) -1. If you want to delete alerts for this {% data variables.product.prodname_code_scanning %} tool, select some or all of the check boxes and click **Delete**. +{% data reusables.code-scanning.false-positive-fix-codeql %} + +{% else %} + +1. If you have admin permissions for the repository, and you want to delete alerts for this {% data variables.product.prodname_code_scanning %} tool, select some or all of the check boxes and click **Delete**. ![Deleting alerts](/assets/images/help/repository/code-scanning-delete-alerts.png) @@ -104,6 +122,8 @@ To dismiss or delete alerts: If a project has multiple alerts that you want to dismiss for the same reason, you can bulk dismiss them from the summary of alerts. Typically, you'll want to filter the list and then dismiss all of the matching alerts. For example, you might want to dismiss all of the current alerts in the project that have been tagged for a particular Common Weakness Enumeration (CWE) vulnerability. +{% endif %} + ### Further reading - "[Triaging {% data variables.product.prodname_code_scanning %} alerts in pull requests](/github/finding-security-vulnerabilities-and-errors-in-your-code/triaging-code-scanning-alerts-in-pull-requests)" diff --git a/content/github/finding-security-vulnerabilities-and-errors-in-your-code/triaging-code-scanning-alerts-in-pull-requests.md b/content/github/finding-security-vulnerabilities-and-errors-in-your-code/triaging-code-scanning-alerts-in-pull-requests.md index 49c84a333e..ab7bf0dbc9 100644 --- a/content/github/finding-security-vulnerabilities-and-errors-in-your-code/triaging-code-scanning-alerts-in-pull-requests.md +++ b/content/github/finding-security-vulnerabilities-and-errors-in-your-code/triaging-code-scanning-alerts-in-pull-requests.md @@ -13,9 +13,9 @@ versions: ### About {% data variables.product.prodname_code_scanning %} results on pull requests -In repositories where {% data variables.product.prodname_code_scanning %} is configured as a pull request check, {% data variables.product.prodname_code_scanning %} checks the code in the pull request. By default, this is limited to pull requests that target the default branch or protected branches, but you can change this configuration within {% data variables.product.prodname_actions %} or in a third-party CI/CD system. If merging the changes would introduce new {% data variables.product.prodname_code_scanning %} alerts to the target branch, these are reported as check results in the pull request. The alerts are also shown as annotations in the **Files changed** tab of the pull request. If you have write permission for the repository, you can see any existing {% data variables.product.prodname_code_scanning %} alerts on the **Security** tab. For information about repository alerts, see "[Managing {% data variables.product.prodname_code_scanning %} alerts for your repository](/github/finding-security-vulnerabilities-and-errors-in-your-code/managing-code-scanning-alerts-for-your-repository)." +In repositories where {% data variables.product.prodname_code_scanning %} is configured as a pull request check, {% data variables.product.prodname_code_scanning %} checks the code in the pull request. By default, this is limited to pull requests that target the default branch, but you can change this configuration within {% data variables.product.prodname_actions %} or in a third-party CI/CD system. If merging the changes would introduce new {% data variables.product.prodname_code_scanning %} alerts to the target branch, these are reported as check results in the pull request. The alerts are also shown as annotations in the **Files changed** tab of the pull request. If you have write permission for the repository, you can see any existing {% data variables.product.prodname_code_scanning %} alerts on the **Security** tab. For information about repository alerts, see "[Managing {% data variables.product.prodname_code_scanning %} alerts for your repository](/github/finding-security-vulnerabilities-and-errors-in-your-code/managing-code-scanning-alerts-for-your-repository)." -If {% data variables.product.prodname_code_scanning %} has any results with a severity of `error`, the check fails and the error is reported in the check results. If all the results found by {% data variables.product.prodname_code_scanning %} have lower severities, the alerts are treated as warnings or notices and the check succeeds. If your pull request targets a protected branch, and the repository owner has configured required status checks, then you must either fix or dismiss all error alerts before the pull request can be merged. For more information, see "[About required status checks](/github/administering-a-repository/about-required-status-checks)." +If {% data variables.product.prodname_code_scanning %} has any results with a severity of `error`, the check fails and the error is reported in the check results. If all the results found by {% data variables.product.prodname_code_scanning %} have lower severities, the alerts are treated as warnings or notices and the check succeeds. If your pull request targets a protected branch that has been enabled for {% data variables.product.prodname_code_scanning %}, and the repository owner has configured required status checks, then you must either fix or {% if currentVersion == "enterprise-server@2.22" %}close{% else %}dismiss{% endif %} all error alerts before the pull request can be merged. For more information, see "[About required status checks](/github/administering-a-repository/about-required-status-checks)." ![Failed {% data variables.product.prodname_code_scanning %} check on a pull request](/assets/images/help/repository/code-scanning-check-failure.png) @@ -39,10 +39,18 @@ In the detailed view for an alert, some {% data variables.product.prodname_code_ ![Alert description and link to show more information](/assets/images/help/repository/code-scanning-pr-alert.png) -### Fixing an alert on your pull request +### {% if currentVersion == "enterprise-server@2.22" %}Resolving{% else %}Fixing{% endif %} an alert on your pull request Anyone with write permission for a repository can fix a {% data variables.product.prodname_code_scanning %} alert that's identified on a pull request. If you commit changes to the pull request this triggers a new run of the pull request checks. If your changes fix the problem, the alert is closed and the annotation removed. +{% if currentVersion == "enterprise-server@2.22" %} + +If you don't think that an alert needs to be fixed, you can close the alert manually. {% data reusables.code-scanning.close-alert-examples %} The **Close** button is available in annotations and in the alerts view if you have write permission for the repository. + +{% data reusables.code-scanning.false-positive-fix-codeql %} + +{% else %} + ### Dismissing an alert on your pull request An alternative way of closing an alert is to dismiss it. You can dismiss an alert if you don't think it needs to be fixed. {% data reusables.code-scanning.close-alert-examples %} If you have write permission for the repository, the **Dismiss** button is available in code annotations and in the alerts summary. When you click **Dismiss** you will be prompted to choose a reason for closing the alert. @@ -54,3 +62,5 @@ An alternative way of closing an alert is to dismiss it. You can dismiss an aler {% data reusables.code-scanning.false-positive-fix-codeql %} For more information about dismissing alerts, see "[Managing {% data variables.product.prodname_code_scanning %} alerts for your repository](/github/finding-security-vulnerabilities-and-errors-in-your-code/managing-code-scanning-alerts-for-your-repository#dismissing-or-deleting-alerts)." + +{% endif %} \ No newline at end of file diff --git a/content/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies.md b/content/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies.md index 734552725a..b6e48cbaec 100644 --- a/content/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies.md +++ b/content/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies.md @@ -49,7 +49,7 @@ You can also enable or disable {% data variables.product.prodname_dependabot %} {% endif %} {% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.21" %} -When {% data variables.product.product_name %} identifies a vulnerable dependency, we send a {% data variables.product.prodname_dependabot_short %} alert to the maintainers of affected repositories with details of the vulnerability, a link to the affected file in the project, and information about a fixed version. {% if currentVersion == "free-pro-team@latest" %}For repositories that have enabled {% data variables.product.prodname_dependabot_security_updates %}, the alert also contains a link to a pull request to update the manifest or lock file to the minimum version that resolves the vulnerability. For more information, see "[Configuring {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/configuring-github-dependabot-security-updates)."{% endif %} +When {% data variables.product.product_name %} identifies a vulnerable dependency, we send a {% data variables.product.prodname_dependabot_short %} alert to the maintainers of affected repositories with details of the vulnerability, a link to the affected file in the project, and information about a fixed version. {% if currentVersion == "free-pro-team@latest" %}For repositories that have enabled {% data variables.product.prodname_dependabot_security_updates %}, the alert will also contain a link to a pull request to update the manifest or lock file to the minimum version that resolves the vulnerability. For more information, see "[About {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/about-github-dependabot-security-updates)."{% endif %} {% endif %} {% if enterpriseServerVersions contains currentVersion and currentVersion ver_lt "enterprise-server@2.22" %} @@ -79,6 +79,6 @@ We send security alerts to people with admin permissions in the affected reposit {% if currentVersion == "free-pro-team@latest" %} ### Further reading -- "[Configuring {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/configuring-github-dependabot-security-updates)" +- "[About {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/about-github-dependabot-security-updates)" - "[Viewing and updating vulnerable dependencies in your repository](/articles/viewing-and-updating-vulnerable-dependencies-in-your-repository)" - "[Understanding how {% data variables.product.product_name %} uses and protects your data](/categories/understanding-how-github-uses-and-protects-your-data)"{% endif %} diff --git a/content/github/managing-security-vulnerabilities/about-github-dependabot-security-updates.md b/content/github/managing-security-vulnerabilities/about-github-dependabot-security-updates.md new file mode 100644 index 0000000000..4b7addb049 --- /dev/null +++ b/content/github/managing-security-vulnerabilities/about-github-dependabot-security-updates.md @@ -0,0 +1,33 @@ +--- +title: About GitHub Dependabot security updates +intro: '{% data variables.product.prodname_dependabot %} can fix vulnerable dependencies for you by raising pull requests with security updates.' +shortTitle: About Dependabot security updates +versions: + free-pro-team: '*' +--- + +### About {% data variables.product.prodname_dependabot_security_updates %} + +{% data variables.product.prodname_dependabot_security_updates %} make it easier for you to fix vulnerable dependencies in your repository. If you enable this feature, when a {% data variables.product.prodname_dependabot_short %} alert is raised for a vulnerable dependency in the dependency graph of your repository, {% data variables.product.prodname_dependabot_short %} automatically tries to fix it. For more information, see "[About alerts for vulnerable dependencies](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)" and "[Configuring {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/configuring-github-dependabot-security-updates)." + +{% data variables.product.prodname_dependabot %} checks whether it's possible to upgrade the vulnerable dependency to a fixed version without disrupting the dependency graph for the repository. Then {% data variables.product.prodname_dependabot_short %} raises a pull request to update the dependency to the minimum version that includes the patch and links the pull request to the {% data variables.product.prodname_dependabot %} alert, or reports an error on the alert. For more information, see "[Troubleshooting {% data variables.product.prodname_dependabot %} errors](/github/managing-security-vulnerabilities/troubleshooting-github-dependabot-errors)." + +{% note %} + +**Note** + +The {% data variables.product.prodname_dependabot_security_updates %} feature is available for repositories where you have enabled the dependency graph and {% data variables.product.prodname_dependabot_short %} alerts. You will see a {% data variables.product.prodname_dependabot_short %} alert for every vulnerable dependency identified in your full dependency graph. However, security updates are triggered only for dependencies that are specified in a manifest or lock file. {% data variables.product.prodname_dependabot_short %} is unable to update an indirect or transitive dependency that is not explicitly defined. For more information, see "[About the dependency graph](/github/visualizing-repository-data-with-graphs/about-the-dependency-graph#dependencies-included)." + +{% endnote %} + +### About pull requests for security updates + +Each pull request contains everything you need to quickly and safely review and merge a proposed fix into your project. This includes information about the vulnerability like release notes, changelog entries, and commit details. Details of which vulnerability a pull request resolves are hidden from anyone who does not have access to {% data variables.product.prodname_dependabot_short %} alerts for the repository. + +When you merge a pull request that contains a security update, the corresponding {% data variables.product.prodname_dependabot_short %} alert is marked as resolved for your repository. For more information about {% data variables.product.prodname_dependabot_short %} pull requests, see "[Managing pull requests for dependency updates](/github/administering-a-repository/managing-pull-requests-for-dependency-updates)." + +{% data reusables.dependabot.automated-tests-note %} + +### About compatibility scores + +{% data variables.product.prodname_dependabot_security_updates %} may include compatibility scores to let you know whether updating a vulnerability could cause breaking changes to your project. These are calculated from CI tests in other public repositories where the same security update has been generated. An update's compatibility score is the percentage of CI runs that passed when updating between specific versions of the dependency. diff --git a/content/github/managing-security-vulnerabilities/browsing-security-vulnerabilities-in-the-github-advisory-database.md b/content/github/managing-security-vulnerabilities/browsing-security-vulnerabilities-in-the-github-advisory-database.md index 19e110d291..4b58d7b897 100644 --- a/content/github/managing-security-vulnerabilities/browsing-security-vulnerabilities-in-the-github-advisory-database.md +++ b/content/github/managing-security-vulnerabilities/browsing-security-vulnerabilities-in-the-github-advisory-database.md @@ -1,6 +1,7 @@ --- title: Browsing security vulnerabilities in the GitHub Advisory Database intro: 'The {% data variables.product.prodname_advisory_database %} allows you to browse or search for vulnerabilities that affect open source projects on {% data variables.product.company_short %}.' +shortTitle: Browsing the Advisory Database versions: free-pro-team: '*' --- diff --git a/content/github/managing-security-vulnerabilities/configuring-github-dependabot-security-updates.md b/content/github/managing-security-vulnerabilities/configuring-github-dependabot-security-updates.md index 990601c5bf..2acde31d0a 100644 --- a/content/github/managing-security-vulnerabilities/configuring-github-dependabot-security-updates.md +++ b/content/github/managing-security-vulnerabilities/configuring-github-dependabot-security-updates.md @@ -5,30 +5,16 @@ redirect_from: - /articles/configuring-automated-security-fixes - /github/managing-security-vulnerabilities/configuring-automated-security-fixes - /github/managing-security-vulnerabilities/configuring-automated-security-updates +shortTitle: Configuring Dependabot security updates versions: free-pro-team: '*' --- -### About {% data variables.product.prodname_dependabot_security_updates %} +### About configuring {% data variables.product.prodname_dependabot_security_updates %} -{% data variables.product.prodname_dependabot_short %} monitors security advisories such as the {% data variables.product.prodname_advisory_database %} and [WhiteSource](https://www.whitesourcesoftware.com/vulnerability-database) and automatically triggers a pull request when it detects a new vulnerable dependency in the dependency graph of repositories. For more information about the {% data variables.product.prodname_advisory_database %}, see "[About the {% data variables.product.prodname_advisory_database %}](/github/managing-security-vulnerabilities/browsing-security-vulnerabilities-in-the-github-advisory-database#about-the-github-advisory-database)." +You can enable {% data variables.product.prodname_dependabot_security_updates %} for any repository that uses {% data variables.product.prodname_dependabot_short %} alerts and the dependency graph. For more information, see "[About {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/about-github-dependabot-security-updates)." -{% data reusables.dependabot.upgrade-dependency-to-minimum-secure-version %} - -{% data variables.product.prodname_dependabot_short %} includes a link to the pull request in the alert for the vulnerable dependency. For more information, see "[About alerts for vulnerable dependencies](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)" and "[About the dependency graph](/github/visualizing-repository-data-with-graphs/about-the-dependency-graph)." - -Each security update contains everything you need to quickly and safely review and merge a proposed fix into your project. This includes information about the vulnerability like release notes, changelog entries, and commit details. Details of which vulnerability a pull request resolves are hidden from anyone who does not have access to {% data variables.product.prodname_dependabot_short %} alerts for the repository. - -When you merge a pull request that contains a security update, the corresponding alert is marked as resolved for your repository. - -{% note %} - -**Note** -{% data variables.product.prodname_dependabot_security_updates %} only resolve security vulnerabilities in the dependencies tracked by your dependency graph. Security updates are not created to resolve vulnerabilities in private registries or packages hosted in private repositories. However, indirect or transitive dependencies are included if they are explicitly defined in a lock file, or similar. For more information, see "[About the dependency graph](/github/visualizing-repository-data-with-graphs/about-the-dependency-graph)." Additionally, it's important to highlight that {% data variables.product.prodname_dependabot_security_updates %} automatically create pulls requests with proposed fixes to the lock files, for the dependencies detected as vulnerable. - -{% endnote %} - -You can enable {% data variables.product.prodname_dependabot_security_updates %} for any repository that uses {% data variables.product.prodname_dependabot_short %} alerts and the dependency graph. You can disable {% data variables.product.prodname_dependabot_security_updates %} for an individual repository or for all repositories owned by your user account or organization. For more information, see "[Managing {% data variables.product.prodname_dependabot_security_updates %} for your repositories](#managing-github-dependabot-security-updates-for-your-repositories)" below. +You can disable {% data variables.product.prodname_dependabot_security_updates %} for an individual repository or for all repositories owned by your user account or organization. For more information, see "[Managing {% data variables.product.prodname_dependabot_security_updates %} for your repositories](#managing-github-dependabot-security-updates-for-your-repositories)" below. {% data reusables.dependabot.dependabot-tos %} @@ -53,10 +39,6 @@ You can enable {% data variables.product.prodname_dependabot_security_updates %} If security updates are not enabled for your repository and you don't know why, first try enabling them using the instructions given in the procedural sections below. If security updates are still not working, you can [contact support](https://support.github.com/contact). -### About compatibility scores - -{% data variables.product.prodname_dependabot_security_updates %} also include compatibility scores to let you know whether updating a vulnerability could cause breaking changes to your project. We look at previously-passing CI tests from public repositories where we've generated a given security update to learn whether the update causes tests to fail. An update's compatibility score is the percentage of CI runs that passed when updating between relevant versions of the dependency. - ### Managing {% data variables.product.prodname_dependabot_security_updates %} for your repositories You can enable or disable {% data variables.product.prodname_dependabot_security_updates %} for an individual repository. diff --git a/content/github/managing-security-vulnerabilities/index.md b/content/github/managing-security-vulnerabilities/index.md index 33684e122b..61c09009e1 100644 --- a/content/github/managing-security-vulnerabilities/index.md +++ b/content/github/managing-security-vulnerabilities/index.md @@ -30,7 +30,9 @@ versions: {% link_in_list /about-alerts-for-vulnerable-dependencies %} {% link_in_list /configuring-notifications-for-vulnerable-dependencies %} + {% link_in_list /about-github-dependabot-security-updates %} {% link_in_list /configuring-github-dependabot-security-updates %} {% link_in_list /viewing-and-updating-vulnerable-dependencies-in-your-repository %} {% link_in_list /troubleshooting-the-detection-of-vulnerable-dependencies %} + {% link_in_list /troubleshooting-github-dependabot-errors %} diff --git a/content/github/managing-security-vulnerabilities/troubleshooting-github-dependabot-errors.md b/content/github/managing-security-vulnerabilities/troubleshooting-github-dependabot-errors.md new file mode 100644 index 0000000000..a376ff1995 --- /dev/null +++ b/content/github/managing-security-vulnerabilities/troubleshooting-github-dependabot-errors.md @@ -0,0 +1,82 @@ +--- +title: Troubleshooting GitHub Dependabot errors +intro: 'Sometimes {% data variables.product.prodname_dependabot %} is unable to raise a pull request to update your dependencies. You can review the error and unblock {% data variables.product.prodname_dependabot_short %}.' +shortTitle: Troubleshooting errors +versions: + free-pro-team: '*' +--- + +{% data reusables.dependabot.beta-note %} + +### About {% data variables.product.prodname_dependabot %} errors + +{% data reusables.dependabot.pull-request-introduction %} + +If anything prevents {% data variables.product.prodname_dependabot_short %} from raising a pull request, this is reported as an error. + +### Investigating errors with {% data variables.product.prodname_dependabot_security_updates %} + +When {% data variables.product.prodname_dependabot_short %} is blocked from creating a pull request to fix a {% data variables.product.prodname_dependabot_short %} alert, it posts the error message on the alert. The {% data variables.product.prodname_dependabot_short %} alerts view shows a list of any alerts that have not been resolved yet. To access the alerts view, click **{% data variables.product.prodname_dependabot_short %} alerts** on the **Security** tab for the repository. Where a pull request that will fix the vulnerable dependency has been generated, the alert includes a link to that pull request. + +![{% data variables.product.prodname_dependabot_short %} alerts view showing a pull request link](/assets/images/help/dependabot/dependabot-alert-pr-link.png) + +There are three reasons why an alert may have no pull request link: + +1. {% data variables.product.prodname_dependabot_security_updates %} are not enabled for the repository. +1. The alert is for an indirect or transitive dependency that is not explicitly defined in a lock file. +1. An error blocked {% data variables.product.prodname_dependabot_short %} from creating a pull request. + +If an error blocked {% data variables.product.prodname_dependabot_short %} from creating a pull request, you can display details of the error by clicking the alert. + +![{% data variables.product.prodname_dependabot_short %} alert showing the error that blocked the creation of a pull request](/assets/images/help/dependabot/dependabot-security-update-error.png) + +### Investigating errors with {% data variables.product.prodname_dependabot_version_updates %} + +When {% data variables.product.prodname_dependabot_short %} is blocked from creating a pull request to update a dependency in an ecosystem, it posts the error icon on the manifest file. The manifest files that are managed by {% data variables.product.prodname_dependabot_short %} are listed on the {% data variables.product.prodname_dependabot_short %} tab. To access this tab, on the **Insights** tab for the repository click **Dependency graph**, and then click the **{% data variables.product.prodname_dependabot_short %}** tab. + +![{% data variables.product.prodname_dependabot_short %} view showing an error](/assets/images/help/dependabot/dependabot-tab-view-error-beta.png) + +To see the log file for any manifest file, click the **Last checked TIME ago** link. When you display the log file for a manifest that's shown with an error symbol (for example, Maven in the screenshot above), any errors are also displayed. + +![{% data variables.product.prodname_dependabot_short %} version update error and log ](/assets/images/help/dependabot/dependabot-version-update-error-beta.png) + +### Understanding {% data variables.product.prodname_dependabot_short %} errors + +Pull requests for security updates act to upgrade a vulnerable dependency to the minimum version that includes a fix for the vulnerability. In contrast, pull requests for version updates act to upgrade a dependency to the latest version allowed by the package manifest and {% data variables.product.prodname_dependabot_short %} configuration files. Consequently, some errors are specific to one type of update. + +#### {% data variables.product.prodname_dependabot_short %} cannot update DEPENDENCY to a non-vulnerable version + +**Security updates only.** {% data variables.product.prodname_dependabot_short %} cannot create a pull request to update the vulnerable dependency to a secure version without breaking other dependencies in the dependency graph for this repository. + +Every application that has dependencies has a dependency graph, that is, a directed acyclic graph of every package version that the application directly or indirectly depends on. Every time a dependency is updated, this graph must resolve otherwise the application won't build. When an ecosystem has a deep and complex dependency graph, for example, npm and RubyGems, it is often impossible to upgrade a single dependency without upgrading the whole ecosystem. + +The best way to avoid this problem is to stay up to date with the most recently released versions, for example, by enabling version updates. This increases the likelihood that a vulnerability in one dependency can be resolved by a simple upgrade that doesn't break the dependency graph. For more information, see "[Enabling and disabling version updates](/github/administering-a-repository/enabling-and-disabling-version-updates)." + +#### {% data variables.product.prodname_dependabot_short %} cannot update to the required version as there is already an open pull request for the latest version + +**Security updates only.** {% data variables.product.prodname_dependabot_short %} will not create a pull request to update the vulnerable dependency to a secure version because there is already an open pull request to update this dependency. You will see this error when a vulnerability is detected in a single dependency and there's already an open pull request to update the dependency to the latest version. + +There are two options: you can review the open pull request and merge it as soon as you are confident that the change is safe, or close that pull request and trigger a new security update pull request. For more information, see "[Triggering a {% data variables.product.prodname_dependabot_short %} pull request manually](#triggering-a-dependabot-pull-request-manually)." + +#### {% data variables.product.prodname_dependabot_short %} timed out during its update + +{% data variables.product.prodname_dependabot_short %} took longer than the maximum time allowed to assess the update required and prepare a pull request. This error is usually seen only for large repositories with many manifest files, for example, npm or yarn monorepo projects with hundreds of *package.json* files. Updates to the Composer ecosystem also take longer to assess and may time out. + +This error is difficult to address. If a version update times out, you could specify the most important dependencies to update using the `allow` parameter or, alternatively, use the `ignore` parameter to exclude some dependencies from updates. Updating your configuration might allow {% data variables.product.prodname_dependabot_short %} to review the version update and generate the pull request in the time available. + +If a security update times out, you can reduce the chances of this happening by keeping the dependencies updated, for example, by enabling version updates. For more information, see "[Enabling and disabling version updates](/github/administering-a-repository/enabling-and-disabling-version-updates)." + +#### {% data variables.product.prodname_dependabot_short %} cannot open any more pull requests + +There's a limit on the number of open pull requests {% data variables.product.prodname_dependabot_short %} will generate. When this limit is reached, no new pull requests are opened and this error is reported. The best way to resolve this error is to review and merge some of the open pull requests. + +There are separate limits for security and version update pull requests, so that open version update pull requests cannot block the creation of a security update pull request. The limit for security update pull requests is 10. By default, the limit for version updates is 5 but you can change this using the `open-pull-requests-limit` parameter in the configuration file. For more information, see "[Configuration options for dependency updates](/github/administering-a-repository/configuration-options-for-dependency-updates#open-pull-requests-limit)." + +The best way to resolve this error is to merge or close some of the existing pull requests and trigger a new pull request manually. For more information, see "[Triggering a {% data variables.product.prodname_dependabot_short %} pull request manually](#triggering-a-dependabot-pull-request-manually)." + +### Triggering a {% data variables.product.prodname_dependabot_short %} pull request manually + +If you unblock {% data variables.product.prodname_dependabot_short %}, you can manually trigger a fresh attempt to create a pull request. + +- **Security updates**—display the {% data variables.product.prodname_dependabot_short %} alert that shows the error you have fixed and click **Create {% data variables.product.prodname_dependabot_short %} security update**. +- **Version updates**—display the log file for the manifest that shows the error that you have fixed and click **Check for updates**. diff --git a/content/github/managing-security-vulnerabilities/troubleshooting-the-detection-of-vulnerable-dependencies.md b/content/github/managing-security-vulnerabilities/troubleshooting-the-detection-of-vulnerable-dependencies.md index 09109cb63f..9926d8bcf2 100644 --- a/content/github/managing-security-vulnerabilities/troubleshooting-the-detection-of-vulnerable-dependencies.md +++ b/content/github/managing-security-vulnerabilities/troubleshooting-the-detection-of-vulnerable-dependencies.md @@ -1,6 +1,7 @@ --- title: Troubleshooting the detection of vulnerable dependencies intro: 'If the dependency information reported by {% data variables.product.product_name %} is not what you expected, there are a number of points to consider, and various things you can check.' +shortTitle: Troubleshooting detection versions: free-pro-team: '*' --- @@ -14,9 +15,9 @@ The results of dependency detection reported by {% data variables.product.produc * {% data variables.product.prodname_advisory_database %} is one of the data sources that {% data variables.product.prodname_dotcom %} uses to identify vulnerable dependencies. It's a free, curated database of vulnerability information for common package ecosystems on {% data variables.product.prodname_dotcom %}. It includes both data reported directly to {% data variables.product.prodname_dotcom %} from {% data variables.product.prodname_security_advisories %}, as well as official feeds and community sources. This data is reviewed and curated by {% data variables.product.prodname_dotcom %} to ensure that false or unactionable information is not shared with the development community. For more information, see "[Browsing security vulnerabilities in the {% data variables.product.prodname_advisory_database %}](/github/managing-security-vulnerabilities/browsing-security-vulnerabilities-in-the-github-advisory-database)" and "[About {% data variables.product.prodname_security_advisories %}](/github/managing-security-vulnerabilities/about-github-security-advisories)." * The dependency graph parses all known package manifest files in a user’s repository. For example, for npm it will parse the _package-lock.json_ file. It constructs a graph of all of the repository’s dependencies and public dependents. This happens when you enable the dependency graph and when anyone pushes to the default branch, and it includes commits that makes changes to a supported manifest format. For more information, see "[About the dependency graph](/github/visualizing-repository-data-with-graphs/about-the-dependency-graph)." * {% data variables.product.prodname_dependabot_short %} scans any push, to the default branch, that contains a manifest file. When a new vulnerability record is added, it scans all existing repositories and generates an alert for each vulnerable repository. {% data variables.product.prodname_dependabot_short %} alerts are aggregated at the repository level, rather than creating one alert per vulnerability. For more information, see "[About alerts for vulnerable dependencies](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)." -* {% data variables.product.prodname_dependabot_security_updates %} are triggered when you receive a security alert about a vulnerable dependency in your repository. {% data variables.product.prodname_dotcom %} automatically creates a pull request in your repository to upgrade the vulnerable dependency to the minimum possible secure version needed to avoid the vulnerability. For more information, see "[Configuring {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/configuring-github-dependabot-security-updates)." +* {% data variables.product.prodname_dependabot_security_updates %} are triggered when you receive an alert about a vulnerable dependency in your repository. Where possible, {% data variables.product.prodname_dependabot_short %} creates a pull request in your repository to upgrade the vulnerable dependency to the minimum possible secure version needed to avoid the vulnerability. For more information, see "[About {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/about-github-dependabot-security-updates)" and "[Troubleshooting {% data variables.product.prodname_dependabot %} errors](/github/managing-security-vulnerabilities/troubleshooting-github-dependabot-errors)." - {% data variables.product.prodname_dependabot_short %} doesn't scan repositories on a schedule, but rather when something changes. For example, a scan is triggered when a new dependency is added ({% data variables.product.prodname_dotcom %} checks for this on every push), or when a new vulnerability is discovered and added to the advisory database. + {% data variables.product.prodname_dependabot_short %} doesn't scan repositories for vulnerable dependencies on a schedule, but rather when something changes. For example, a scan is triggered when a new dependency is added ({% data variables.product.prodname_dotcom %} checks for this on every push), or when a new vulnerability is discovered and added to the advisory database. ### Why don't I get vulnerability alerts for some ecosystems? @@ -97,3 +98,4 @@ When you click to display the alert details, you can see how many vulnerabilitie - "[About alerts for vulnerable dependencies](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)" - "[Viewing and updating vulnerable dependencies in your repository](/github/managing-security-vulnerabilities/viewing-and-updating-vulnerable-dependencies-in-your-repository)" - "[Managing security and analysis settings for your repository](/github/administering-a-repository/managing-security-and-analysis-settings-for-your-repository)" +- "[Troubleshooting {% data variables.product.prodname_dependabot %} errors](/github/managing-security-vulnerabilities/troubleshooting-github-dependabot-errors)" diff --git a/content/github/managing-security-vulnerabilities/viewing-and-updating-vulnerable-dependencies-in-your-repository.md b/content/github/managing-security-vulnerabilities/viewing-and-updating-vulnerable-dependencies-in-your-repository.md index bbb866e0cb..d60cba9bf6 100644 --- a/content/github/managing-security-vulnerabilities/viewing-and-updating-vulnerable-dependencies-in-your-repository.md +++ b/content/github/managing-security-vulnerabilities/viewing-and-updating-vulnerable-dependencies-in-your-repository.md @@ -4,16 +4,17 @@ intro: 'If {% data variables.product.product_name %} discovers vulnerable depend redirect_from: - /articles/viewing-and-updating-vulnerable-dependencies-in-your-repository permissions: Repository administrators and organization owners can view and update dependencies. +shortTitle: Viewing and updating vulnerable dependencies versions: free-pro-team: '*' --- Your repository's {% data variables.product.prodname_dependabot %} alerts tab lists all open and closed {% data variables.product.prodname_dependabot_alerts %} and corresponding {% data variables.product.prodname_dependabot_security_updates %}. You can sort the list of alerts using the drop-down menu, and you can click into specific alerts for more details. For more information, see "[About alerts for vulnerable dependencies](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)." -You can enable automatic security updates for any repository that uses {% data variables.product.prodname_dependabot_alerts %} and the dependency graph. For more information, see "[Configuring {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/configuring-github-dependabot-security-updates)." +You can enable automatic security updates for any repository that uses {% data variables.product.prodname_dependabot_alerts %} and the dependency graph. For more information, see "[About {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/about-github-dependabot-security-updates)." ### About updates for vulnerable dependencies in your repository -{% data variables.product.product_name %} sends {% data variables.product.prodname_dependabot_alerts %} when we detect vulnerabilities affecting your repository. For repositories where {% data variables.product.prodname_dependabot_security_updates %} are enabled, when {% data variables.product.product_name %} detects a vulnerable dependency {% data variables.product.prodname_dependabot_short %} creates a pull request to fix it. {% data reusables.dependabot.upgrade-dependency-to-minimum-secure-version %} +{% data variables.product.product_name %} sends {% data variables.product.prodname_dependabot_alerts %} when we detect vulnerabilities affecting your repository. For repositories where {% data variables.product.prodname_dependabot_security_updates %} are enabled, when {% data variables.product.product_name %} detects a vulnerable dependency {% data variables.product.prodname_dependabot_short %} creates a pull request to fix it. The pull request will upgrade the dependency to the minimum possible secure version needed to avoid the vulnerability. ### Viewing and updating vulnerable dependencies @@ -35,3 +36,4 @@ You can enable automatic security updates for any repository that uses {% data v - "[Configuring {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/configuring-github-dependabot-security-updates)" - "[Managing security and analysis settings for your repository](/github/administering-a-repository/managing-security-and-analysis-settings-for-your-repository)" - "[Troubleshooting the detection of vulnerable dependencies](/github/managing-security-vulnerabilities/troubleshooting-the-detection-of-vulnerable-dependencies)" +- "[Troubleshooting {% data variables.product.prodname_dependabot %} errors](/github/managing-security-vulnerabilities/troubleshooting-github-dependabot-errors)" diff --git a/content/github/setting-up-and-managing-organizations-and-teams/permission-levels-for-an-organization.md b/content/github/setting-up-and-managing-organizations-and-teams/permission-levels-for-an-organization.md index be3bf1afa9..92257d1682 100644 --- a/content/github/setting-up-and-managing-organizations-and-teams/permission-levels-for-an-organization.md +++ b/content/github/setting-up-and-managing-organizations-and-teams/permission-levels-for-an-organization.md @@ -63,7 +63,7 @@ Organization members can have *owner*{% if currentVersion == "free-pro-team@late | Purchase, install, manage billing for, and cancel {% data variables.product.prodname_marketplace %} apps | **X** | | | | List apps in {% data variables.product.prodname_marketplace %} | **X** | | | | Receive [{% data variables.product.prodname_dependabot_alerts %} about vulnerable dependencies](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies) for all of an organization's repositories | **X** | | | -| Manage {% data variables.product.prodname_dependabot_security_updates %} (see "[Configuring {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/configuring-github-dependabot-security-updates)") | **X** | | | +| Manage {% data variables.product.prodname_dependabot_security_updates %} (see "[About {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/about-github-dependabot-security-updates)") | **X** | | | | [Manage the forking policy](/github/setting-up-and-managing-organizations-and-teams/managing-the-forking-policy-for-your-organization) | **X** | | | | [Limit activity in public repositories in an organization](/articles/limiting-interactions-in-your-organization) | **X** | | | | Pull (read), push (write), and clone (copy) *all repositories* in the organization | **X** | | | diff --git a/data/reusables/code-scanning/click-alert-in-list.md b/data/reusables/code-scanning/click-alert-in-list.md new file mode 100644 index 0000000000..314164be42 --- /dev/null +++ b/data/reusables/code-scanning/click-alert-in-list.md @@ -0,0 +1,2 @@ +1. Under "Code scanning," click the alert you'd like to explore. + ![List of alerts from {% data variables.product.prodname_code_scanning %}](/assets/images/help/repository/code-scanning-click-alert.png) diff --git a/data/reusables/code-scanning/false-positive-fix-codeql.md b/data/reusables/code-scanning/false-positive-fix-codeql.md index 116630a498..011f129f12 100644 --- a/data/reusables/code-scanning/false-positive-fix-codeql.md +++ b/data/reusables/code-scanning/false-positive-fix-codeql.md @@ -1 +1 @@ -If you dismiss a {% data variables.product.prodname_codeql %} alert as a false positive result, for example because the code uses a sanitization library that isn't supported, consider contributing to the {% data variables.product.prodname_codeql %} repository and improving the analysis. For more information about {% data variables.product.prodname_codeql %}, see "[Contributing to {% data variables.product.prodname_codeql %}](https://github.com/github/codeql/blob/main/CONTRIBUTING.md)." +If you {% if currentVersion == "enterprise-server@2.22" %}close{% else %}dismiss{% endif %} a {% data variables.product.prodname_codeql %} alert as a false positive result, for example because the code uses a sanitization library that isn't supported, consider contributing to the {% data variables.product.prodname_codeql %} repository and improving the analysis. For more information about {% data variables.product.prodname_codeql %}, see "[Contributing to {% data variables.product.prodname_codeql %}](https://github.com/github/codeql/blob/main/CONTRIBUTING.md)." diff --git a/data/reusables/dependabot/upgrade-dependency-to-minimum-secure-version.md b/data/reusables/dependabot/automated-tests-note.md similarity index 80% rename from data/reusables/dependabot/upgrade-dependency-to-minimum-secure-version.md rename to data/reusables/dependabot/automated-tests-note.md index 52127e64ed..1f15a27f8e 100644 --- a/data/reusables/dependabot/upgrade-dependency-to-minimum-secure-version.md +++ b/data/reusables/dependabot/automated-tests-note.md @@ -1,5 +1,3 @@ -The pull request will upgrade the dependency to the minimum possible secure version needed to avoid the vulnerability. - {% note %} **Note:** It's good practice to have automated tests and acceptance processes in place so that checks are carried out before the pull request is merged. This is particularly important if the suggested version to upgrade to contains additional functionality, or a change that breaks your project's code. For more information about continuous integration, see "[About continuous integration](/actions/building-and-testing-code-with-continuous-integration/about-continuous-integration)." diff --git a/data/reusables/dependabot/pull-request-introduction.md b/data/reusables/dependabot/pull-request-introduction.md new file mode 100644 index 0000000000..7494d21059 --- /dev/null +++ b/data/reusables/dependabot/pull-request-introduction.md @@ -0,0 +1 @@ +{% data variables.product.prodname_dependabot %} raises pull requests to update dependencies. Depending on how your repository is configured, {% data variables.product.prodname_dependabot_short %} may raise pull requests for version updates and/or for security updates. You manage these pull requests in the same way as any other pull request, but there are also some extra commands available. For information about enabling {% data variables.product.prodname_dependabot %} dependency updates, see "[Configuring {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/configuring-github-dependabot-security-updates)" and "[Enabling and disabling version updates](/github/administering-a-repository/enabling-and-disabling-version-updates)." \ No newline at end of file diff --git a/lib/hydro.js b/lib/hydro.js index 6ef062e7e7..2f246a09d9 100644 --- a/lib/hydro.js +++ b/lib/hydro.js @@ -21,6 +21,13 @@ module.exports = class Hydro { this.schemas = SCHEMAS } + /** + * Can check if it can actually send to Hydro + */ + maySend () { + return Boolean(this.secret && this.endpoint) + } + /** * Generate a SHA256 hash of the payload using the secret * to authenticate with Hydro diff --git a/middleware/index.js b/middleware/index.js index 225abb7c89..98106e419c 100644 --- a/middleware/index.js +++ b/middleware/index.js @@ -16,6 +16,9 @@ module.exports = function (app) { app.use(require('morgan')('dev', { skip: (req, res) => !isDevelopment })) app.use(require('./rate-limit')) if (isDevelopment) app.use(require('./webpack')) + app.use(require('./cookie-parser')) + app.use(require('./req-utils')) + app.use(require('./record-redirect')) app.use(require('./redirects/external')) app.use(require('./redirects/help-to-docs')) app.use(require('./set-fastly-cache-headers')) @@ -24,9 +27,7 @@ module.exports = function (app) { app.use(require('./cors')) app.use(require('./csp')) app.use(require('helmet')()) - app.use(require('./req-utils')) app.use(require('./robots')) - app.use(require('./cookie-parser')) app.use(express.json()) // Must come before ./csrf app.use(require('./csrf')) app.use(require('./handle-csrf-errors')) diff --git a/middleware/record-redirect.js b/middleware/record-redirect.js new file mode 100644 index 0000000000..564f0d37d6 --- /dev/null +++ b/middleware/record-redirect.js @@ -0,0 +1,27 @@ +const { v4: uuidv4 } = require('uuid') +const { inRange } = require('lodash') + +module.exports = function (req, res, next) { + if (!req.hydro.maySend()) return next() + + res.on('finish', async function recordRedirect () { + if (!inRange(res.statusCode, 300, 400)) return + const schemaName = req.hydro.schemas.redirect + const redirectEvent = { + context: { + user: req.cookies['_docs-events'] || uuidv4(), + event_id: uuidv4(), + version: '1.0.0', + created: new Date().toISOString(), + path: req.path, + referrer: req.get('referer') + }, + redirect_from: req.originalUrl, + redirect_to: res.get('location') + } + const hydroRes = await req.hydro.publish(schemaName, redirectEvent) + if (!hydroRes.ok) console.log('Failed to record redirect to Hydro') + }) + + return next() +} diff --git a/package-lock.json b/package-lock.json index 3ac9cb1d9c..63ae8cf871 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1131,9 +1131,9 @@ } }, "@github-docs/render-content": { - "version": "5.1.0", - "resolved": "https://registry.npmjs.org/@github-docs/render-content/-/render-content-5.1.0.tgz", - "integrity": "sha512-d0Is3zPvumal5MYRYcZv0X2jwzEV3e5/OTwWTi2s9ZVWK53TwoHvO0r+I2Z0XQfHDKZgM6V0h2lZhRIJxcYsMg==", + "version": "5.2.0", + "resolved": "https://registry.npmjs.org/@github-docs/render-content/-/render-content-5.2.0.tgz", + "integrity": "sha512-/rrDSvspp+xRn7xHD+0Wv7oobn8yw8qx1BN7rpoS2PpNIgmd9QBNW8m8aS8CI2Y41BF7wPSDvxxx8EYoKsXlDQ==", "requires": { "@primer/octicons": "^11.0.0", "cheerio": "^1.0.0-rc.3", @@ -1141,7 +1141,7 @@ "hastscript": "^6.0.0", "html-entities": "^1.2.1", "hubdown": "^2.6.0", - "liquid": "^5.0.0", + "liquid": "^5.1.0", "parse5": "^6.0.1", "remark-code-extra": "^1.0.1", "semver": "^5.7.1", @@ -4206,7 +4206,7 @@ }, "browserify-aes": { "version": "1.2.0", - "resolved": "http://registry.npmjs.org/browserify-aes/-/browserify-aes-1.2.0.tgz", + "resolved": "https://registry.npmjs.org/browserify-aes/-/browserify-aes-1.2.0.tgz", "integrity": "sha512-+7CHXqGuspUn/Sl5aO7Ea0xWGAtETPXNSAjHo48JfLdPWcMng33Xe4znFvQweqc/uzk5zSOI3H52CYnjCfb5hA==", "requires": { "buffer-xor": "^1.0.3", @@ -4240,7 +4240,7 @@ }, "browserify-rsa": { "version": "4.0.1", - "resolved": "http://registry.npmjs.org/browserify-rsa/-/browserify-rsa-4.0.1.tgz", + "resolved": "https://registry.npmjs.org/browserify-rsa/-/browserify-rsa-4.0.1.tgz", "integrity": "sha1-IeCr+vbyApzy+vsTNWenAdQTVSQ=", "requires": { "bn.js": "^4.1.0", @@ -5657,7 +5657,7 @@ }, "create-hash": { "version": "1.2.0", - "resolved": "http://registry.npmjs.org/create-hash/-/create-hash-1.2.0.tgz", + "resolved": "https://registry.npmjs.org/create-hash/-/create-hash-1.2.0.tgz", "integrity": "sha512-z00bCGNHDG8mHAkP7CtT1qVu+bFQUPjYq/4Iv3C3kWjTFV10zIjfSoeqXo9Asws8gwSHDGj/hl2u4OGIjapeCg==", "requires": { "cipher-base": "^1.0.1", @@ -5669,7 +5669,7 @@ }, "create-hmac": { "version": "1.1.7", - "resolved": "http://registry.npmjs.org/create-hmac/-/create-hmac-1.1.7.tgz", + "resolved": "https://registry.npmjs.org/create-hmac/-/create-hmac-1.1.7.tgz", "integrity": "sha512-MJG9liiZ+ogc4TzUwuvbER1JRdgvUFSB5+VR/g5h82fGaIRWMWddtKBHi7/sVhfjQZ6SehlyhvQYrcYkaUIpLg==", "requires": { "cipher-base": "^1.0.3", @@ -6396,7 +6396,7 @@ }, "diffie-hellman": { "version": "5.0.3", - "resolved": "http://registry.npmjs.org/diffie-hellman/-/diffie-hellman-5.0.3.tgz", + "resolved": "https://registry.npmjs.org/diffie-hellman/-/diffie-hellman-5.0.3.tgz", "integrity": "sha512-kqag/Nl+f3GwyK25fhUMYj81BUOrZ9IuJsjIcDE5icNM9FJHAVm3VcUDxdLPoQtTuUylWm6ZIknYJwwaPxsUzg==", "requires": { "bn.js": "^4.1.0", @@ -9958,9 +9958,9 @@ "integrity": "sha512-Io1zA2yOA1YJslkr+AJlWSf2yWFkKjvkcL9Ni1XSUqnGLr/qRQe2UI3Cn/J9MsJht7yEVCe0SscY1HgVMujbgg==" }, "highlight.js": { - "version": "10.2.1", - "resolved": "https://registry.npmjs.org/highlight.js/-/highlight.js-10.2.1.tgz", - "integrity": "sha512-A+sckVPIb9zQTUydC9lpRX1qRFO/N0OKEh0NwIr65ckvWA/oMY8v9P3+kGRK3w2ULSh9E8v5MszXafodQ6039g==" + "version": "10.3.1", + "resolved": "https://registry.npmjs.org/highlight.js/-/highlight.js-10.3.1.tgz", + "integrity": "sha512-jeW8rdPdhshYKObedYg5XGbpVgb1/DT4AHvDFXhkU7UnGSIjy9kkJ7zHG7qplhFHMitTSzh5/iClKQk3Kb2RFQ==" }, "highlightjs-graphql": { "version": "1.0.2", @@ -14953,9 +14953,9 @@ "dev": true }, "liquid": { - "version": "5.0.0", - "resolved": "https://registry.npmjs.org/liquid/-/liquid-5.0.0.tgz", - "integrity": "sha512-lpoE6D+nLSn4W0SwdV1B2EWX+DXFeroSAFk29+XLyO9Y+/k9yRZ4SyoGQCcAHw9kt/G6D/nJaHlStZbbknpsUg==", + "version": "5.1.0", + "resolved": "https://registry.npmjs.org/liquid/-/liquid-5.1.0.tgz", + "integrity": "sha512-bL1FuJSqKsmk4UVTiWnxpyuwR70YOJnV3eSztEVe3MbsHB+f9FsEPaSRM1upVJLxTQyv9A+FP5tZhoQq3S7EWQ==", "requires": { "strftime": "~0.9.2" }, @@ -15144,12 +15144,12 @@ "integrity": "sha512-G2Lj61tXDnVFFOi8VZds+SoQjtQC3dgokKdDG2mTm1tx4m50NUHBOZSBwQQHyy0V12A0JTG4icfZQH+xPyh8VA==" }, "lowlight": { - "version": "1.15.0", - "resolved": "https://registry.npmjs.org/lowlight/-/lowlight-1.15.0.tgz", - "integrity": "sha512-GhG/R+2zt5Wg8kCfOhapH8wDdJSHSIvdDW/DOPXCeResVqgHYLnOHBp6g9DoUIPVIyBpvQYCG4SV7XeelYFpyA==", + "version": "1.16.0", + "resolved": "https://registry.npmjs.org/lowlight/-/lowlight-1.16.0.tgz", + "integrity": "sha512-ECLdzIJvBEjK4ef51sWiGZyz21yx4IEPaF/62DRxLehoOHkWqN3OsLB1GUMfc6Mcf87rR5eW7z6lI9cNEXZDsQ==", "requires": { "fault": "^1.0.0", - "highlight.js": "~10.2.0" + "highlight.js": "~10.3.0" } }, "lru-cache": { @@ -19071,7 +19071,7 @@ }, "sha.js": { "version": "2.4.11", - "resolved": "http://registry.npmjs.org/sha.js/-/sha.js-2.4.11.tgz", + "resolved": "https://registry.npmjs.org/sha.js/-/sha.js-2.4.11.tgz", "integrity": "sha512-QMEp5B7cftE7APOjk5Y6xgrbWu+WkLVQwk8JNjZ8nKRciZaByEW6MubieAiToS7+dwvrjGhH8jRXz3MVd0AYqQ==", "requires": { "inherits": "^2.0.1", diff --git a/package.json b/package.json index 8368be49c1..a7dd3bbd09 100644 --- a/package.json +++ b/package.json @@ -15,7 +15,7 @@ "@babel/runtime": "^7.11.2", "@github-docs/data-directory": "^1.2.0", "@github-docs/frontmatter": "^1.3.1", - "@github-docs/render-content": "^5.1.0", + "@github-docs/render-content": "^5.2.0", "@github/rest-api-operations": "^3.1.4", "@octokit/rest": "^16.38.1", "@primer/css": "^15.1.0", @@ -50,7 +50,7 @@ "js-cookie": "^2.2.1", "js-yaml": "^3.14.0", "lil-env-thing": "^1.0.0", - "liquid": "^5.0.0", + "liquid": "^5.1.0", "lodash": "^4.17.19", "mini-css-extract-plugin": "^0.9.0", "mkdirp": "^1.0.3", diff --git a/tests/links-and-images/developer-links-and-images.js b/tests/links-and-images/developer-links-and-images.js index e323098535..42c2a3af98 100644 --- a/tests/links-and-images/developer-links-and-images.js +++ b/tests/links-and-images/developer-links-and-images.js @@ -9,6 +9,8 @@ const { getVersionedPathWithLanguage } = require('../../lib/path-utils') const renderContent = require('../../lib/render-content') const checkImages = require('../../lib/check-images') const checkLinks = require('../../lib/check-developer-links') +const enterpriseServerVersions = Object.keys(require('../../lib/all-versions')) + .filter(version => version.startsWith('enterprise-server@')) const { getOldVersionFromNewVersion } = require('../../lib/old-versions-utils') // schema-derived data to add to context object @@ -64,6 +66,7 @@ describe('page rendering', () => { page.version = pageVersion context.page = page context.currentVersion = pageVersion + context.enterpriseServerVersions = enterpriseServerVersions const relevantPermalink = page.permalinks.find(permalink => permalink.pageVersion === pageVersion) diff --git a/tests/links-and-images/links-and-images.js b/tests/links-and-images/links-and-images.js index 031425f41c..4eb607f80a 100644 --- a/tests/links-and-images/links-and-images.js +++ b/tests/links-and-images/links-and-images.js @@ -5,6 +5,8 @@ const getApplicableVersions = require('../../lib/get-applicable-versions') const renderContent = require('../../lib/render-content') const checkImages = require('../../lib/check-images') const checkLinks = require('../../lib/check-links') +const enterpriseServerVersions = Object.keys(require('../../lib/all-versions')) + .filter(version => version.startsWith('enterprise-server@')) const flat = require('flat') const { last } = require('lodash') @@ -56,6 +58,7 @@ describe('page rendering', () => { page.version = pageVersion context.page = page context.currentVersion = pageVersion + context.enterpriseServerVersions = enterpriseServerVersions // collect elements of the page that may contain links const pageContent = page.intro + page.permissions + page.markdown diff --git a/translations/de-DE/content/github/authenticating-to-github/githubs-ssh-key-fingerprints.md b/translations/de-DE/content/github/authenticating-to-github/githubs-ssh-key-fingerprints.md index e17a75f598..798c333ccd 100644 --- a/translations/de-DE/content/github/authenticating-to-github/githubs-ssh-key-fingerprints.md +++ b/translations/de-DE/content/github/authenticating-to-github/githubs-ssh-key-fingerprints.md @@ -9,12 +9,7 @@ versions: free-pro-team: '*' --- -Dies sind die öffentlichen Schlüssel-Fingerprints von {% data variables.product.prodname_dotcom %} (im Hexadezimalformat): - -- `16:27:ac:a5:76:28:2d:36:63:1b:56:4d:eb:df:a6:48` (RSA) -- `ad:1c:08:a4:40:e3:6f:9c:f5:66:26:5d:4b:33:5d:8c` (DSA) - -Dies sind die SHA256-Hashes, die in OpenSSH 6.8 und höher angezeigt werden (im base64-Format): +Dies sind die öffentlichen Schlüssel-Fingerprints von {% data variables.product.prodname_dotcom %}: - `SHA256:nThbg6kXUpJWGl7E1IGOCspRomTxdCARLviKw6E5SY8` (RSA) - `SHA256:br9IjFspm1vxR3iA35FWE+4VTyz1hYVLIE2t1/CeyWQ` (DSA) diff --git a/translations/de-DE/content/github/authenticating-to-github/testing-your-ssh-connection.md b/translations/de-DE/content/github/authenticating-to-github/testing-your-ssh-connection.md index 5aefc509ff..e355a014a5 100644 --- a/translations/de-DE/content/github/authenticating-to-github/testing-your-ssh-connection.md +++ b/translations/de-DE/content/github/authenticating-to-github/testing-your-ssh-connection.md @@ -24,14 +24,6 @@ Für den Test Deiner Verbindung musst Du diese Aktion mit Deinem Passwort authen Eventuell erhälst Du eine Warnung wie die folgende: - ```shell - > The authenticity of host '{% data variables.command_line.codeblock %} (IP ADDRESS)' can't be established. - > RSA key fingerprint is 16:27:ac:a5:76:28:2d:36:63:1b:56:4d:eb:df:a6:48. - > Are you sure you want to continue connecting (yes/no)? - ``` - - oder wie diese: - ```shell > The authenticity of host '{% data variables.command_line.codeblock %} (IP ADDRESS)' can't be established. > RSA key fingerprint is SHA256:nThbg6kXUpJWGl7E1IGOCspRomTxdCARLviKw6E5SY8. diff --git a/translations/es-XL/content/github/authenticating-to-github/githubs-ssh-key-fingerprints.md b/translations/es-XL/content/github/authenticating-to-github/githubs-ssh-key-fingerprints.md index eba603ea79..759f2f7512 100644 --- a/translations/es-XL/content/github/authenticating-to-github/githubs-ssh-key-fingerprints.md +++ b/translations/es-XL/content/github/authenticating-to-github/githubs-ssh-key-fingerprints.md @@ -9,12 +9,7 @@ versions: free-pro-team: '*' --- -Estas son las huellas digitales de clave pública de {% data variables.product.prodname_dotcom %} (en formato hexadecimal): - -- `16:27:ac:a5:76:28:2d:36:63:1b:56:4d:eb:df:a6:48` (RSA) -- `ad:1c:08:a4:40:e3:6f:9c:f5:66:26:5d:4b:33:5d:8c` (DSA) - -Estos son los hashes SHA256 que se muestran en OpenSSH 6.8 y versiones posteriores (en formato base64): +Estas son las huellas digitales de clave pública de {% data variables.product.prodname_dotcom %}: - `SHA256:nThbg6kXUpJWGl7E1IGOCspRomTxdCARLviKw6E5SY8` (RSA) - `SHA256:br9IjFspm1vxR3iA35FWE+4VTyz1hYVLIE2t1/CeyWQ` (DSA) diff --git a/translations/es-XL/content/github/authenticating-to-github/testing-your-ssh-connection.md b/translations/es-XL/content/github/authenticating-to-github/testing-your-ssh-connection.md index 7d5a7fcd0e..4bbfd236c7 100644 --- a/translations/es-XL/content/github/authenticating-to-github/testing-your-ssh-connection.md +++ b/translations/es-XL/content/github/authenticating-to-github/testing-your-ssh-connection.md @@ -24,14 +24,6 @@ Cuando pruebes tu conexión, tendrás que autenticar esta acción utilizando tu Puedes ver una advertencia como la siguiente: - ```shell - > La autenticidad del host '{% data variables.command_line.codeblock %} (DIRECCIÓN IP)' no se puede establecer. - > La clave de huella digital RSA es 16:27:ac:a5:76:28:2d:36:63:1b:56:4d:eb:df:a6:48. - > ¿Estás seguro de que quieres continuar conectado (sí/no)? - ``` - - o como la siguiente: - ```shell > La autenticidad del host '{% data variables.command_line.codeblock %} (DIRECCIÓN IP)' no se puede establecer. > La clave de huella digital RSA es SHA256:nThbg6kXUpJWGl7E1IGOCspRomTxdCARLviKw6E5SY8. diff --git a/translations/ja-JP/content/github/authenticating-to-github/githubs-ssh-key-fingerprints.md b/translations/ja-JP/content/github/authenticating-to-github/githubs-ssh-key-fingerprints.md index 4b85a5dfea..ae4767e0ba 100644 --- a/translations/ja-JP/content/github/authenticating-to-github/githubs-ssh-key-fingerprints.md +++ b/translations/ja-JP/content/github/authenticating-to-github/githubs-ssh-key-fingerprints.md @@ -9,12 +9,7 @@ versions: free-pro-team: '*' --- -{% data variables.product.prodname_dotcom %} のパブリックキーフィンガープリントを以下に示します (16 進形式): - -- `16:27:ac:a5:76:28:2d:36:63:1b:56:4d:eb:df:a6:48` (RSA) -- `ad:1c:08:a4:40:e3:6f:9c:f5:66:26:5d:4b:33:5d:8c` (DSA) - -OpenSSH 6.8 以降で表示される SHA256 ハッシュを次に示します (base64 形式): +{% data variables.product.prodname_dotcom %} のパブリックキーフィンガープリントを以下に示します: - `SHA256:nThbg6kXUpJWGl7E1IGOCspRomTxdCARLviKw6E5SY8` (RSA) - `SHA256:br9IjFspm1vxR3iA35FWE+4VTyz1hYVLIE2t1/CeyWQ` (DSA) diff --git a/translations/ja-JP/content/github/authenticating-to-github/testing-your-ssh-connection.md b/translations/ja-JP/content/github/authenticating-to-github/testing-your-ssh-connection.md index 5fb9890937..916809879e 100644 --- a/translations/ja-JP/content/github/authenticating-to-github/testing-your-ssh-connection.md +++ b/translations/ja-JP/content/github/authenticating-to-github/testing-your-ssh-connection.md @@ -24,14 +24,6 @@ SSH 接続をテストする前に、次のことを済ませておく必要が 以下のような警告が表示される場合があります: - ```shell - > The authenticity of host '{% data variables.command_line.codeblock %} (IP ADDRESS)' can't be established. - > RSA key fingerprint is 16:27:ac:a5:76:28:2d:36:63:1b:56:4d:eb:df:a6:48. - > Are you sure you want to continue connecting (yes/no)? - ``` - - また、以下のように表示される場合もあります: - ```shell > The authenticity of host '{% data variables.command_line.codeblock %} (IP ADDRESS)' can't be established. > RSA key fingerprint is SHA256:nThbg6kXUpJWGl7E1IGOCspRomTxdCARLviKw6E5SY8. diff --git a/translations/ko-KR/content/github/authenticating-to-github/githubs-ssh-key-fingerprints.md b/translations/ko-KR/content/github/authenticating-to-github/githubs-ssh-key-fingerprints.md index 007a22af6d..309b4e69c1 100644 --- a/translations/ko-KR/content/github/authenticating-to-github/githubs-ssh-key-fingerprints.md +++ b/translations/ko-KR/content/github/authenticating-to-github/githubs-ssh-key-fingerprints.md @@ -9,12 +9,7 @@ versions: free-pro-team: '*' --- -These are {% data variables.product.prodname_dotcom %}'s public key fingerprints (in hexadecimal format): - -- `16:27:ac:a5:76:28:2d:36:63:1b:56:4d:eb:df:a6:48` (RSA) -- `ad:1c:08:a4:40:e3:6f:9c:f5:66:26:5d:4b:33:5d:8c` (DSA) - -These are the SHA256 hashes shown in OpenSSH 6.8 and newer (in base64 format): +These are {% data variables.product.prodname_dotcom %}'s public key fingerprints: - `SHA256:nThbg6kXUpJWGl7E1IGOCspRomTxdCARLviKw6E5SY8` (RSA) - `SHA256:br9IjFspm1vxR3iA35FWE+4VTyz1hYVLIE2t1/CeyWQ` (DSA) diff --git a/translations/ko-KR/content/github/authenticating-to-github/testing-your-ssh-connection.md b/translations/ko-KR/content/github/authenticating-to-github/testing-your-ssh-connection.md index b70b2278b2..a1b6502337 100644 --- a/translations/ko-KR/content/github/authenticating-to-github/testing-your-ssh-connection.md +++ b/translations/ko-KR/content/github/authenticating-to-github/testing-your-ssh-connection.md @@ -24,14 +24,6 @@ When you test your connection, you'll need to authenticate this action using you You may see a warning like this: - ```shell - > The authenticity of host '{% data variables.command_line.codeblock %} (IP ADDRESS)' can't be established. - > RSA key fingerprint is 16:27:ac:a5:76:28:2d:36:63:1b:56:4d:eb:df:a6:48. - > Are you sure you want to continue connecting (yes/no)? - ``` - - or like this: - ```shell > The authenticity of host '{% data variables.command_line.codeblock %} (IP ADDRESS)' can't be established. > RSA key fingerprint is SHA256:nThbg6kXUpJWGl7E1IGOCspRomTxdCARLviKw6E5SY8. diff --git a/translations/pt-BR/content/github/authenticating-to-github/githubs-ssh-key-fingerprints.md b/translations/pt-BR/content/github/authenticating-to-github/githubs-ssh-key-fingerprints.md index 111eaf040c..c43ad06c94 100644 --- a/translations/pt-BR/content/github/authenticating-to-github/githubs-ssh-key-fingerprints.md +++ b/translations/pt-BR/content/github/authenticating-to-github/githubs-ssh-key-fingerprints.md @@ -9,12 +9,7 @@ versions: free-pro-team: '*' --- -Estas são as impressões digitais da chave pública do {% data variables.product.prodname_dotcom %} (em formato hexadecimal): - -- `16:27:ac:a5:76:28:2d:36:63:1b:56:4d:eb:df:a6:48` (RSA) -- `ad:1c:08:a4:40:e3:6f:9c:f5:66:26:5d:4b:33:5d:8c` (DSA) - -Estas são as hashes apresentadas no OpenSSH 6.8 e posterior (no formato base64): +Estas são as impressões digitais da chave pública do {% data variables.product.prodname_dotcom %}: - `SHA256:nThbg6kXUpJWGl7E1IGOCspRomTxdCARLviKw6E5SY8` (RSA) - `SHA256:br9IjFspm1vxR3iA35FWE+4VTyz1hYVLIE2t1/CeyWQ` (DSA) diff --git a/translations/pt-BR/content/github/authenticating-to-github/testing-your-ssh-connection.md b/translations/pt-BR/content/github/authenticating-to-github/testing-your-ssh-connection.md index 31dd5c0229..5586b1f6c1 100644 --- a/translations/pt-BR/content/github/authenticating-to-github/testing-your-ssh-connection.md +++ b/translations/pt-BR/content/github/authenticating-to-github/testing-your-ssh-connection.md @@ -24,14 +24,6 @@ Quando você testar a conexão, precisará autenticar essa ação usando sua sen Você poderá receber um aviso como este: - ```shell - > Não é possível estabelecer a autenticidade do host '{% data variables.command_line.codeblock %} (IP ADDRESS)'. - > A impressão digital da chave RSA é 16:27:ac:a5:76:28:2d:36:63:1b:56:4d:eb:df:a6:48. - > Tem certeza de que deseja continuar com a conexão (sim/não)? - ``` - - ou como este: - ```shell > Não é possível estabelecer a autenticidade do host '{% data variables.command_line.codeblock %} (IP ADDRESS)'. > A impressão digital da chave RSA é SHA256:nThbg6kXUpJWGl7E1IGOCspRomTxdCARLviKw6E5SY8. diff --git a/translations/ru-RU/content/github/authenticating-to-github/githubs-ssh-key-fingerprints.md b/translations/ru-RU/content/github/authenticating-to-github/githubs-ssh-key-fingerprints.md index 007a22af6d..309b4e69c1 100644 --- a/translations/ru-RU/content/github/authenticating-to-github/githubs-ssh-key-fingerprints.md +++ b/translations/ru-RU/content/github/authenticating-to-github/githubs-ssh-key-fingerprints.md @@ -9,12 +9,7 @@ versions: free-pro-team: '*' --- -These are {% data variables.product.prodname_dotcom %}'s public key fingerprints (in hexadecimal format): - -- `16:27:ac:a5:76:28:2d:36:63:1b:56:4d:eb:df:a6:48` (RSA) -- `ad:1c:08:a4:40:e3:6f:9c:f5:66:26:5d:4b:33:5d:8c` (DSA) - -These are the SHA256 hashes shown in OpenSSH 6.8 and newer (in base64 format): +These are {% data variables.product.prodname_dotcom %}'s public key fingerprints: - `SHA256:nThbg6kXUpJWGl7E1IGOCspRomTxdCARLviKw6E5SY8` (RSA) - `SHA256:br9IjFspm1vxR3iA35FWE+4VTyz1hYVLIE2t1/CeyWQ` (DSA) diff --git a/translations/ru-RU/content/github/authenticating-to-github/testing-your-ssh-connection.md b/translations/ru-RU/content/github/authenticating-to-github/testing-your-ssh-connection.md index b70b2278b2..a1b6502337 100644 --- a/translations/ru-RU/content/github/authenticating-to-github/testing-your-ssh-connection.md +++ b/translations/ru-RU/content/github/authenticating-to-github/testing-your-ssh-connection.md @@ -24,14 +24,6 @@ When you test your connection, you'll need to authenticate this action using you You may see a warning like this: - ```shell - > The authenticity of host '{% data variables.command_line.codeblock %} (IP ADDRESS)' can't be established. - > RSA key fingerprint is 16:27:ac:a5:76:28:2d:36:63:1b:56:4d:eb:df:a6:48. - > Are you sure you want to continue connecting (yes/no)? - ``` - - or like this: - ```shell > The authenticity of host '{% data variables.command_line.codeblock %} (IP ADDRESS)' can't be established. > RSA key fingerprint is SHA256:nThbg6kXUpJWGl7E1IGOCspRomTxdCARLviKw6E5SY8. diff --git a/translations/zh-CN/content/github/authenticating-to-github/githubs-ssh-key-fingerprints.md b/translations/zh-CN/content/github/authenticating-to-github/githubs-ssh-key-fingerprints.md index 821dc9d957..1db4958f93 100644 --- a/translations/zh-CN/content/github/authenticating-to-github/githubs-ssh-key-fingerprints.md +++ b/translations/zh-CN/content/github/authenticating-to-github/githubs-ssh-key-fingerprints.md @@ -9,12 +9,7 @@ versions: free-pro-team: '*' --- -以下是 {% data variables.product.prodname_dotcom %} 的公钥指纹（十六进制格式）： - -- `16:27:ac:a5:76:28:2d:36:63:1b:56:4d:eb:df:a6:48` (RSA) -- `ad:1c:08:a4:40:e3:6f:9c:f5:66:26:5d:4b:33:5d:8c` (DSA) - -以下是 OpenSSH 6.8 和更新版本中显示的 SHA256 哈希（base64 格式）： +以下是 {% data variables.product.prodname_dotcom %} 的公钥指纹 ： - `SHA256:nThbg6kXUpJWGl7E1IGOCspRomTxdCARLviKw6E5SY8` (RSA) - `SHA256:br9IjFspm1vxR3iA35FWE+4VTyz1hYVLIE2t1/CeyWQ` (DSA) diff --git a/translations/zh-CN/content/github/authenticating-to-github/testing-your-ssh-connection.md b/translations/zh-CN/content/github/authenticating-to-github/testing-your-ssh-connection.md index fa9f2c333b..84794c469c 100644 --- a/translations/zh-CN/content/github/authenticating-to-github/testing-your-ssh-connection.md +++ b/translations/zh-CN/content/github/authenticating-to-github/testing-your-ssh-connection.md @@ -24,14 +24,6 @@ versions: 您可能会看到类似如下的警告： - ```shell - > The authenticity of host '{% data variables.command_line.codeblock %} (IP ADDRESS)' can't be established. - > RSA key fingerprint is 16:27:ac:a5:76:28:2d:36:63:1b:56:4d:eb:df:a6:48. - > Are you sure you want to continue connecting (yes/no)? - ``` - - 或类似如下： - ```shell > The authenticity of host '{% data variables.command_line.codeblock %} (IP ADDRESS)' can't be established. > RSA key fingerprint is SHA256:nThbg6kXUpJWGl7E1IGOCspRomTxdCARLviKw6E5SY8.