GitHub Dependabot - Overview

The GitHub Dependabot plug-in imports repository vulnerability data from GitHub server into DevOps Velocity.
It scans for existing GitHub integrations and retrieves data only for those particular GitHub repositories.
The Plugin works on repository level and imports data for entire repository.
The GitHub Dependabot leverage the existing GitHub plug-in to scan and link against known repositories. It is highly recommend that you install and configure the existing GitHub plug-in before you install the GitHub Dependabot plug-in.
GitHub Dependabot Alerts should be enabled for the GitHub repository. Automated pull requests generated by Dependabot will be also visible in the Value Stream.
This is a scheduled event plug-in and runs on a timed interval. If data ever gets out of sync, please leverage the Last Initial Sync utility.

Compatibility

The plug-in works on top of GitHub plug-in so at least one GitHub integration should be already there.

The following table lists the compatible versions of the Dependabot plug-in and DevOps Velocity:

DevOps Velocity Version	Dependabot plug-in version
5.2.5 or later	1.0.13

DevOps Velocity plug-in images are located in DockerHub. To view available versions, see the UrbanCode DockerHub.

Vulnerability fix: Addressed and resolved Whitesource-reported vulnerabilities.
Sonarqube coverage: Improved test coverage for the Dependabot plug-in.
Enhancement: Added support for Team and Teamspace fields in plugin integrations. These fields can now be configured during plugin setup and integration.
Technical upgrade: Upgraded the NPM Wrapper package to the latest supported version.