Dependency graph and Dependabot alerts no longer enabled by default since 2025/06/17
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
- 难度
- 2/5
- 预计耗时
- 1-3 小时
- 新手友好度
- 69/100
- Issue 类型
- 文档
- 描述清晰度
- 描述清楚
- 活跃度
- 活跃
- 技术栈
- typescript
调研方向
Issue 提到了四个受影响的文档页面：依赖关系图概念页面、两篇 Dependabot 指南，以及安全与分析设置页面。首先在文档仓库中找到这些页面，并对照链接的 changelog 检查当前措辞。更新声称公共仓库默认启用依赖关系图或警报的内容；当四个页面都准确描述当前行为时，即为完成。
由索引模型根据 Issue 内容生成。
描述
Code of Conduct
- I have read and agree to the GitHub Docs project's Code of Conduct
What article on docs.github.com is affected?
Based on this blog post Dependency graph now defaults to off and personally reproduced, Dependency graph and Dependabot alerts are no longer enabled by default.
A few docs still mention the old behavior:
- https://docs.github.com/en/code-security/concepts/supply-chain-security/dependency-graph - The alert box mentions "Public repositories (on by default)"
- https://docs.github.com/en/[email protected]/code-security/getting-started/quickstart-for-securing-your-repository#managing-dependabot-alerts - Public repositories are enabled by default...
- https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-public-repositories - Other features are permanently enabled for public repositories, such as the dependency graph, which shows you all the libraries and packages that your repository depends upon.
- https://docs.github.com/en/[email protected]/admin/configuring-settings/configuring-github-connect/enabling-dependabot-for-your-enterprise#enabling-dependabot-alerts - Public repositories are always enabled by default.
What part(s) of the article would you like to see updated?
Please see above links - we should update the reflect current behavior that Dependency graph and Dependabot alerts must be explicitly enabled even in public repos.
Additional information
See snippet of a screenshot for a new public repo.
Disclosure: The security features under my personal account are all in a disabled state - but I'm unable to recall whether I'd turned them off myself or if OFF is their default state (docs here don't mention the default state for the features in a personal account). If I'd turned them off myself, then likely the OFF state for the dependency graph and alerts is my fault; but if they're in the default state, then I think this issue remains valid.
Happy to raise a PR is the issue is valid.
- 主要语言
- TypeScript
- 星标
- 21.1k
- 派生
- 69.3k
- 平均合并
- 17 小时 10 分钟
- 30 天内合并 PR
- 89
环境准备
在浏览器里用你自己的 GitHub 账号启动这个项目的开发容器。
- 提供 Dockerfile 或 Docker Compose 文件
- 有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
github/docs 的其他 Issue
-
Incorrect tool permission option names in copilot app documentation可能已有人在做 @ashis-baral 于 1 天前认领。 未关闭content
难度 1/5 1 小时以内 新手友好度 88/100
维护者通常 1 天内回复
-
actions builder persona content
难度 1/5 1 小时以内 新手友好度 86/100
维护者通常 1 天内回复
-
Remove models already deprecated (GPT-4o, GPT-5.1 series, Gemini 3 Pro) from "Model multipliers for annual plans on request-based billing (legacy)"可能重新可做 关联的 PR 已关闭且未合并。 未关闭builder persona content driver persona
难度 1/5 1-3 小时 新手友好度 82/100
维护者通常 1 天内回复
-
builder persona
难度 1/5 1-3 小时 新手友好度 88/100
维护者通常 1 天内回复
-
builder persona content copilot
难度 1/5 1-3 小时 新手友好度 72/100
维护者通常 1 天内回复
相似的 Issue
-
area: cli bug flake ready-for-agent
难度 2/5 1-3 小时 新手友好度 62/100
gazetta-studio/gazetta-studio#1772 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 82/100
-
needs-triage
难度 2/5 1-3 小时 新手友好度 66/100
microsoft/playwright#43875 · 1 条评论 ·
维护者通常 1 天内回复
-
documentation good first issue
难度 2/5 1-3 小时 新手友好度 68/100
维护者通常 1 天内回复
-
feature
难度 2/5 1-3 小时 新手友好度 78/100
维护者通常 1 天内回复