What is the GitHub 'Dependency Graph' feature and what is its relationship to Dependabot?
Select an answer to reveal the explanation.
Short Explanation and Infographic
The Dependency Graph is Dependabot's eyes. GitHub parses your package.json, requirements.txt, Gemfile.lock, and other manifests to build the Dependency Graph. Dependabot then uses that graph — 'this repo uses lodash 4.17.20' — to check against the Advisory Database and alert you or open fix PRs.
Full explanation below image
Full Explanation
The GitHub Dependency Graph is a feature that automatically parses supported package manifest and lockfiles to create a graph of all dependencies (and their transitive dependencies) for a repository. Supported ecosystems include npm, pip, Maven, Gradle, Bundler, Composer, NuGet, Go, Cargo, and more. The Dependency Graph enables: (1) Dependabot alerts — Dependabot reads the dependency graph and cross-references against the GitHub Advisory Database to generate security alerts. (2) Dependabot security updates — Dependabot proposes PRs to update vulnerable dependencies based on the graph. (3) Dependabot version updates — uses the dependency graph to identify what can be updated. (4) SBOM export — generate a Software Bill of Materials from the dependency graph. The Dependency Graph is enabled by default on public repositories and can be enabled for private repositories in settings.