{"meta":{"title":"Securing your dependencies","intro":"Keep your supply chain secure by understanding and updating dependencies.","product":"Security and code quality","breadcrumbs":[{"href":"/en/code-security","title":"Security and code quality"},{"href":"/en/code-security/how-tos","title":"How-tos"},{"href":"/en/code-security/how-tos/secure-your-supply-chain","title":"Secure your supply chain"},{"href":"/en/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies","title":"Secure your dependencies"}],"documentType":"subcategory"},"body":"# Securing your dependencies\n\nKeep your supply chain secure by understanding and updating dependencies.\n\n## Links\n\n* [Configuring Dependabot alerts](/en/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/configure-dependabot-alerts)\n\n  Enable Dependabot alerts to be generated when a new vulnerable dependency is found in one of your repositories.\n\n* [Configuring Dependabot malware alerts](/en/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/configure-malware-alerts)\n\n  Prevent malware attacks by identifying and remediating malicious dependencies.\n\n* [Configuring Dependabot security updates](/en/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/configure-security-updates)\n\n  You can use Dependabot security updates or manual pull requests to easily update vulnerable dependencies.\n\n* [Configuring Dependabot version updates](/en/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/configure-version-updates)\n\n  You can configure your repository so that Dependabot automatically updates the packages you use.\n\n* [Managing innersource advisories](/en/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/manage-innersource-advisories)\n\n  Create, distribute, and withdraw enterprise-scoped advisories to alert your internal repositories to vulnerabilities and ship fixes automatically.\n\n* [Keeping your actions up to date with Dependabot](/en/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/auto-update-actions)\n\n  You can use Dependabot to keep the actions you use updated to the latest versions.\n\n* [Configuring multi-ecosystem updates for Dependabot](/en/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/configuring-multi-ecosystem-updates)\n\n  Reduce the number of Dependabot pull requests you receive by grouping updates across multiple ecosystems into a single, consolidated pull request.\n\n* [Enabling the dependency graph](/en/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/enable-dependency-graph)\n\n  You can allow users to identify their projects' dependencies by enabling the dependency graph.\n\n* [Exploring the dependencies of a repository](/en/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/explore-dependencies)\n\n  You can use the dependency graph to see the packages your project depends on. In addition, you can see any vulnerabilities detected in its dependencies.\n\n* [Configuring automatic dependency submission for your repository](/en/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/submit-dependencies-automatically)\n\n  You can use automatic dependency submission to submit transitive dependency data in your repository. This enables you to analyze these transitive dependencies using the dependency graph.\n\n* [Using the dependency submission API](/en/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/use-dependency-submission-api)\n\n  You can use the dependency submission API to submit dependencies for projects, such as the dependencies resolved when a project is built or compiled.\n\n* [Verifying the integrity of a release](/en/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/verify-release-integrity)\n\n  You can avoid tampering and accidental changes by ensuring the releases you use have not been modified after publication."}