Dependabot Alerts Update

Dependabot Alerts Update

Automatically fetch Dependabot security alerts from GitHub and update vulnerable packages to secure versions.

Workflow

1. Fetch Dependabot Alerts

Use GitHub REST API to fetch open Dependabot alerts:

# Get repository owner and name from git remote
git remote get-url origin

# Fetch alerts (requires GITHUB_TOKEN)
curl -H "Authorization: token $GITHUB_TOKEN" \
  -H "Accept: application/vnd.github+json" \
  "https://api.github.com/repos/{owner}/{repo}/dependabot/alerts?state=open"

Or use the GitHub CLI if available:

gh api repos/{owner}/{repo}/dependabot/alerts --jq '.[] | select(.state == "open")'

Required environment variable: GITHUB_TOKEN with security_events scope.

2. Parse and Categorize Alerts

For each alert, extract:

• Package name (dependency.package.name)
• Severity (security_advisory.severity: critical, high, moderate, low)
• Vulnerable versions (security_vulnerability.vulnerable_version_range)
• CVE/GHSA ID (security_advisory.ghsa_id or security_advisory.cve_id)
• Manifest path (dependency.manifest_path)

Group alerts by:

1. Direct dependencies (in package.json files)
2. Transitive dependencies (will be resolved via direct dependency updates)
3. Severity (prioritize critical/high first)

3. Research Secure Versions

For each vulnerable package, determine the minimum secure version:

1. Check alert API response - The security_vulnerability.first_patched_version field often contains the fixed version:

   gh api repos/{owner}/{repo}/dependabot/alerts/{alert_number} | jq '.security_vulnerability.first_patched_version'

2. Search for security advisories:

   • GitHub Security Advisories: https://github.com/advisories?query={package}
   • npm security: npm audit {package}
   • Snyk: https://security.snyk.io/package/npm/{package}

3. Web search for CVE details and fixed versions:

   • Search: {package} {CVE_ID} fixed version
   • Search: {package} {GHSA_ID} fixed version
   • Check package changelog/release notes

4. Verify compatibility:

   • Check if secure version is compatible with current version range
   • Consider breaking changes in major version updates
   • For peer dependencies, ensure the providing package is updated

4. Update package.json Files

Identify All package.json Files

For monorepos, find all package.json files:

find . -name "package.json" -not -path "*/node_modules/*" -not -path "*/.git/*"

Update Strategy

1. Direct dependencies: Update version in package.json
2. Transitive dependencies: Update parent package that brings in the vulnerable dependency
3. Workspace dependencies: Update in root or specific workspace package

Update Pattern

For each vulnerable package found in package.json:

// Before
"package-name": "^1.2.3"

// After (if 1.5.0 fixes the vulnerability)
"package-name": "^1.5.0"

Use ^ prefix to allow patch/minor updates unless major version is required.

Monorepo Considerations

• pnpm workspaces: Update in the specific workspace package.json
• npm workspaces: Same approach
• Lerna: Update in individual package.json files
• Root dependencies: Update root package.json if used across workspaces

5. Handle Special Cases

Multiple Versions of Same Package

If the same package appears in multiple package.json files with different versions:

• Update all instances to the same secure version
• Ensure compatibility across workspaces

Peer Dependencies

For peer dependencies, update the package that provides the dependency, not the peer dependency declaration itself.

Lock Files

After updating package.json:

• pnpm: Run pnpm install to update pnpm-lock.yaml
• npm: Run npm install to update package-lock.json
• yarn: Run yarn install to update yarn.lock

Note: Some example directories may have separate lock files that need individual updates.

6. Verification

After updates:

1. Check remaining alerts:

   gh api repos/{owner}/{repo}/dependabot/alerts?state=open

2. Run audit:

   pnpm audit  # or npm audit / yarn audit

3. Test build:

   pnpm run build

Implementation

Using the Script

A Node.js script is provided in scripts/fetch_and_fix_alerts.mjs that automates the workflow:

# Set GitHub token
export GITHUB_TOKEN=your_token_here

# Dry run to see what would be updated
node scripts/fetch_and_fix_alerts.mjs --dry-run

# Actually update packages
node scripts/fetch_and_fix_alerts.mjs

# Or specify repo explicitly
node scripts/fetch_and_fix_alerts.mjs --owner OWNER --repo REPO --token TOKEN

The script:

1. Auto-detects repository from git remote
2. Fetches all open Dependabot alerts
3. Finds packages in package.json files
4. Updates versions (uses first_patched_version from API when available)
5. Preserves version prefixes (^, ~)

Requirements: Node.js 18+ (uses native fetch API, no external dependencies)