What is the GitHub Advisory Database?
Select an answer to reveal the explanation.
Short Explanation and Infographic
The Advisory Database is GitHub's vulnerability encyclopedia. It's a curated dataset of CVEs and security advisories for open source packages that Dependabot uses to know which package versions are vulnerable. Without it, Dependabot would have nothing to compare against.
Full explanation below image
Full Explanation
The GitHub Advisory Database is a publicly accessible, curated dataset of security vulnerabilities in open source software. It aggregates data from CVE (Common Vulnerabilities and Exposures) records, security advisories submitted directly to GitHub, and other sources. The database powers Dependabot alerts — when Dependabot finds a package in a repository's dependency graph, it checks the Advisory Database for known vulnerabilities affecting that package version and generates alerts. The database is browsable at github.com/advisories and includes severity ratings, affected versions, patched versions, and remediation guidance. Organizations can also submit their own advisories for packages they maintain. It is not about GitHub's own incidents or user audit records.