GitHub's new security mechanism: security alerts will appear when developers introduce insecure libraries

Published on: 11-21


Code hosting service GitHub has added a new feature that now warns developers of vulnerable software repositories in their projects and suggests fixes to resolve the issue.


GitHub recently introduced dependency graphs, a feature that lists all the libraries used by a project. The new features support JavaScript and Ruby, and the company plans to add support for Python next year.

The new security feature is designed to alert developers when a project's dependencies are vulnerable. GitHub has automatically enabled dependency graphs and security alerts for public repo, but not for private repo.


Dependency graphs can alert project owners when they use vulnerable libraries, notify project owners, and get fixes from GitHub.

"Over 75% of GitHub projects today have dependencies, and we need to do more than help people see these important projects. With your dependency graph enabled, when we detect one of your dependencies We will now notify you when there are vulnerabilities and suggest fixes accordingly," GitHub said.

JavaScript and Ruby projects are currently supported.
Currently , dependency graph supports package.json files (for JavaScript projects) and gemfiles (for Ruby projects), and support for Python is expected to be added next year.


A new security feature added to the dependency graph is an alert system that will warn users when one of the dependent libraries loaded through these manifest files is affected by a publicly known vulnerability. The GIF below shows how these alerts work.



Dependency Graph also sends email notifications that a project updates information using vulnerable dependencies (libraries) or GitHub to update its database with new vulnerabilities.



Miju Han, GitHub's director of product, said GitHub's engineers would first use the CVE vulnerability identification system to track known security vulnerabilities, but they also committed to sending out vulnerability alerts where known security researchers failed to obtain CVE ID numbers.


Users looking for a (somewhat) similar vulnerability scanner for the dependency graph used by PHP Composer based projects can use Roave's SecurityAdvisories project.

For more information, please refer to: https://help.github.com/articles/about-security-alerts-for-vulnerable-dependencies/

[This post was re-edited by Zhenghe at 2017-11-21 09:47