Comments (6)
martincostello
commented on June 5, 2024
1
Isn't what your asking for just CodeQL and Dependabot security alerts?
from dependabot-core.
JamieMagee
commented on June 5, 2024
1
+1 to @martincostello. SAST is outside the scope of dependabot, but in scope for CodeQL.
@mcandre if you have never received any alerts from CodeQL double check your configuration, and maybe enable the extended ruleset. The documentation @martincostello explains how to do that.
from dependabot-core.
mcandre
commented on June 5, 2024
Perhaps.
Is CodeQL automatically enabled for all FOSS GitHub.com repositories like Dependabot?
Does CodeQL come with any stock rules?
I occasionally receive actionable Dependabot notifications, but I've never seen one from CodeQL. So that SAST tool has not been on my radar.
from dependabot-core.
martincostello
commented on June 5, 2024
Is CodeQL automatically enabled for all FOSS GitHub.com repositories like Dependabot?
No, you need to turn it on, and then possibly configure it, depending on which language(s) you use.
Does CodeQL come with any stock rules?
Yes it does - I refer you to their documentation on how to use it: Configuring default setup for code scanning
from dependabot-core.
mcandre
commented on June 5, 2024
Why not enable CodeQL by default, just like Dependabot?
Just assume that millions of repos are needlessly vulnerable.
…On Thu, Apr 25, 2024, 9:07 AM Jamie Magee ***@***.***> wrote:
Closed #9608 <#9608>
as not planned.
—
Reply to this email directly, view it on GitHub
<#9608 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AAABJRCZA7UVNIL2IT7HC73Y7EEZPAVCNFSM6AAAAABGXY66E6VHI2DSMVQWIX3LMV45UABCJFZXG5LFIV3GK3TUJZXXI2LGNFRWC5DJN5XDWMJSGYYDSMRZGI3DEOA>
.
You are receiving this because you were mentioned.Message ID:
***@***.***>
from dependabot-core.
JamieMagee
commented on June 5, 2024
I see your point, but unfortunately, it's not related to Dependabot.
Can you open an issue in the CodeQL repository? https://github.com/github/codeql
from dependabot-core.
Related Issues (20)
- Changing the semantic version stops dependabot package updates
- Support for Gradle Multi-Module Conventions/Pre-Compiled Script Plugins
- All pull requests have 'across 1 directory' in the title since today HOT 5
- Enable YJIT
- Allow custom command execution before install
- Dependabot PR titles suddenly less specific: `across 1 directory` rather than `in /website` HOT 2
- `GET /{package}/{version}` on GitHub Packages returns 405
- Bot attempts to update pre-1.0 minor version number
- Dependabot can't parse your `pnpm-lock.yaml` (new lockfile in `pnpm` `v9.0.0`) HOT 2
- `dependency-type: development` updates even production dependencies in composer ecosystem HOT 1
- skip X number of versions of a package HOT 1
- Github Graphql returns none for author if dependabot PR
- NuGet version update with version number having 4 segments fail
- Updating Terrafrom version for tfenv
- Dependabot tries to update more dependencies than declared HOT 1
- @dependabot ignore X patch version only works in group PR
- Multi-directory support bug with go, terraform, docker HOT 4
- Multi-directory PR creation with Terraform HOT 1
- Ant/Ivy Support
- Unable to rebase with dependency "next"
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from dependabot-core.