GitHub update will help you squash the hidden security bugs in your code
GitHub developers get new alerts to make open source development safer
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
GitHub will now send a Dependabot alert for vulnerable GitHub Actions which could make it easier to stay up to date and fix security vulnerabilities in your actions workflows.
GitHub Actionsis the platform’s continuous integration and delivery (CI/CD) solution, which allows users to automate their software development pipeline.
The new alerts will be powered by the GitHub Advisory Database, which is a security vulnerability database inclusive of Common Vulnerabilities and Exposures (CVEs) and GitHub-originated security advisories taken from the world of open source software.
How can I enable the feature?
To receive alerts on GitHub Actions and vulnerabilities impacting your code, you can enable Dependabot by selecting “Enable all” under the Code security and analysis tab.
If you already happen to be using Dependabot, no problem, there is no additional action required.
You can also contribute some of your wisdom to help other users become more secure.
If you are the owner of a GitHub Action and you discover a vulnerability, you can start the process of creating an advisory from the security tab in your repository.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
Once the repository advisory is created and tagged within the GitHub Action ecosystem, the GitHub curation team will review the repository advisory and create a global advisory when appropriate.
You can find out more about managing vulnerable dependencies on GitHub by headinghere.
The latest GitHub update solves major headaches for developers>Github is closing one of its most popular dev tools>Our guide to the best laptops for devs
Github isn’t the only company that is looking to remedy some of the vulnerabilities related to open source code, which is a common way for cybercriminals to try and hijackendpoints.
It’s a topic that gaining the attention of the wider technology industry, which is understandable as open source vulnerabilities have been the causes of some of the most devasting cyber attacks of the past few years,including the Log4j attack.
Googlerecentlysaidit “will continue to make open source security a priority and urge others to do the same because the health and availability of open source projects strengthen the security posture of users and developers everywhere.”
Will McCurdy has been writing about technology for over five years. He has a wide range of specialities including cybersecurity, fintech, cryptocurrencies, blockchain, cloud computing, payments, artificial intelligence, retail technology, and venture capital investment. He has previously written for AltFi, FStech, Retail Systems, and National Technology News and is an experienced podcast and webinar host, as well as an avid long-form feature writer.
This new malware utilizes a rare programming language to evade traditional detection methods
A new form of macOS malware is being used by devious North Korean hackers
Arcane season 2 confirms the hit series isn’t just one of the best Netflix shows ever made – it’s an animated legend that’ll stand the test of time
