ossf/scorecard
1
1
Fork 0
mirror of https://github.com/ossf/scorecard.git synced 2024-11-04 03:52:31 +03:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

📖 Dependabot config file link (#1498)

Browse Source 
* Dependabot config file link

It seems like dependabot.com is gone and the documentation of configuration file has now moved to https://docs.github.com/en/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/configuration-options-for-dependency-updates

* Updated dependabot docs link

Co-authored-by: Naveen <172697+naveensrinivasan@users.noreply.github.com>
This commit is contained in:
Hallgeir Holien 2022-01-21 17:12:22 +01:00 committed by GitHub
parent 0d76deace2
commit 062e33ba29
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
docs/checks.md
View File

@ -291,7 +291,7 @@ The highest score is awarded when all workflows avoid the dangerous code pattern
Risk: `High` (possibly vulnerable to attacks on known flaws)
This check tries to determine if the project uses a dependency update tool,
specifically [dependabot](https://dependabot.com/docs/config-file/) or
specifically [dependabot](https://docs.github.com/en/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/configuration-options-for-dependency-updates) or
[renovatebot](https://docs.renovatebot.com/configuration-options/). Out-of-date
dependencies make a project vulnerable to known flaws and prone to attacks.
These tools automate the process of updating dependencies by scanning for
@ -309,7 +309,7 @@ low score is therefore not a definitive indication that the project is at risk.
**Remediation steps**
- Signup for automatic dependency updates with [dependabot](https://dependabot.com/docs/config-file/) or [renovatebot](https://docs.renovatebot.com/configuration-options/) and place the config file in the locations that are recommended by these tools. Due to https://github.com/dependabot/dependabot-core/issues/2804 Dependabot can be enabled for forks where security updates have ever been turned on so projects maintaining stable forks should evaluate whether this behavior is satisfactory before turning it on.
- Signup for automatic dependency updates with [dependabot](https://docs.github.com/en/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/configuration-options-for-dependency-updates) or [renovatebot](https://docs.renovatebot.com/configuration-options/) and place the config file in the locations that are recommended by these tools. Due to https://github.com/dependabot/dependabot-core/issues/2804 Dependabot can be enabled for forks where security updates have ever been turned on so projects maintaining stable forks should evaluate whether this behavior is satisfactory before turning it on.
## Fuzzing

4
docs/checks/internal/checks.yaml
View File

@ -50,7 +50,7 @@ checks:
Risk: `High` (possibly vulnerable to attacks on known flaws)
This check tries to determine if the project uses a dependency update tool,
specifically [dependabot](https://dependabot.com/docs/config-file/) or
specifically [dependabot](https://docs.github.com/en/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/configuration-options-for-dependency-updates) or
[renovatebot](https://docs.renovatebot.com/configuration-options/). Out-of-date
dependencies make a project vulnerable to known flaws and prone to attacks.
These tools automate the process of updating dependencies by scanning for
@ -69,7 +69,7 @@ checks:
remediation:
- >-
Signup for automatic dependency updates with
[dependabot](https://dependabot.com/docs/config-file/) or
[dependabot](https://docs.github.com/en/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/configuration-options-for-dependency-updates) or
[renovatebot](https://docs.renovatebot.com/configuration-options/) and place
the config file in the locations that are recommended by these tools. Due to
https://github.com/dependabot/dependabot-core/issues/2804 Dependabot can