{"meta":{"title":"Finding and fixing your first dependency vulnerability","intro":"Learn how to keep your dependencies secure by enabling Dependabot and its features in a demo repository.","product":"Get started","breadcrumbs":[{"href":"/en/get-started","title":"Get started"},{"href":"/en/get-started/learning-to-code","title":"Learn to code"},{"href":"/en/get-started/learning-to-code/finding-and-fixing-your-first-dependency-vulnerability","title":"Secure your dependencies"}],"documentType":"article"},"body":"# Finding and fixing your first dependency vulnerability\n\nLearn how to keep your dependencies secure by enabling Dependabot and its features in a demo repository.\n\nUsing pre-written collections of code in your project, called **libraries** or **packages**, is common practice. These code modules save you a ton of time, letting you focus on the new, creative aspects of your work instead of coding large reusable components from scratch. When added to your project, they are called **dependencies**, since your work is dependent on the code they contain.\n\nWhile using dependencies is perfectly normal, dependencies can contain code vulnerabilities, which would in turn make your project insecure. Luckily, tools like Dependabot can find dependency vulnerabilities, raise pull requests to fix them, and even prevent them from happening in the future. In this tutorial, you'll learn how to enable and use Dependabot and its features to keep your dependencies secure.\n\n## Setting up the demo repository\n\nLet's get started by forking a demo project with some dependency vulnerabilities. Since we won't deploy the project, there is **no security risk** in this exercise.\n\n1. Navigate to the [`new2code/dependabot-demo`](https://github.com/new2code/dependabot-demo) repository.\n2. In the top right of the page, click **Fork**.\n3. On the page that appears, click **Create fork**.\n\n## Enabling dependency security features\n\nNow that we've set up the project, let's configure Dependabot to find and create fixes for insecure dependencies.\n\n1. In the navigation bar for your repository, click ** Security and quality**.\n2. In the \"Dependabot alerts\" row, click **Enable Dependabot alerts**.\n3. In the \"Dependabot\" section, next to \"Dependabot alerts\", click **Enable**.\n4. In the pop up that appears, read the statement about enabling the dependency graph, then click **Enable**.\n5. To allow Dependabot to automatically open pull requests fixing dependency vulnerabilities, next to \"Dependabot security updates\", click **Enable**.\n\n## Viewing your insecure dependencies\n\nWith Dependabot configured, let's find out which of our dependencies contain vulnerabilities.\n\n1. In the navigation bar for your repository, click ** Security and quality**.\n2. To see the Dependabot alerts for your repository, in the side navigation, click **Dependabot**.\n3. To see detailed information about an alert, click the alert title. For this exercise, click **Command Injection in hot-formula-parser**.\n\n## Understanding a Dependabot alert\n\nNow that Dependabot has identified some vulnerabilities in our dependencies, let's break down the information provided in the \"Command Injection in hot-formula-parser\" alert.\n\n### Fix summary\n\nBelow the title of the alert, you can see a short summary of the **fix** for this vulnerability, including the number of alerts it will close and the location of the vulnerability. In our case, the alert tells us that upgrading the `hot-formula-parser` package to version 3.0.1 will fix one Dependabot alert identified in our `javascript/package-lock.json` file.\n\nThis section also tracks Dependabot's progress creating a pull request to fix the vulnerability. Once a fix is available, you'll see a button labeled \" Review security update\" linking to the pull request.\n\n\n\n### Vulnerability details\n\nBelow the fix details, Dependabot provides more information about the vulnerability, including:\n\n* The name of the vulnerable package\n* The versions of the package that contain the vulnerability\n* The version of the package that fixes the vulnerability\n* Details on the type of vulnerability and how it can be exploited\n\n\n\nIn this alert, we can see that the `parse` function in the `hot-formula-parser` package doesn't properly check that user input is safe before executing it, which allows attackers to run malicious commands.\n\n> \\[!TIP] If you don't fully understand the vulnerability details, try [asking Copilot Chat](https://github.com/copilot) to explain them.\n\n### Timeline\n\nFinally, you can see the timeline of the alert at the bottom of the page. Our timeline currently contains the timestamp when Dependabot opened the alert, and will be updated automatically when we fix the vulnerability.\n\n\n\n## Securing your dependencies\n\nTo secure our project quickly and easily, let's apply the fix Dependabot created.\n\n1. In the alert field with the fix summary, click **Review security update**.\n2. On the pull request page, click **Files changed** to see Dependabot's changes. After you review the changes, click **Conversation** to return to the pull request overview.\n3. To apply the fix, at the bottom of the page, click **Merge pull request**, then click **Confirm merge**.\n\n Once the pull request merges, the linked Dependabot alert will close automatically, and the fix time will be added to the timeline.\n\n## Preventing future dependency vulnerabilities\n\nTo help avoid insecure dependencies moving forward, let's allow Dependabot to automatically open pull requests updating your dependencies as new versions are released.\n\n1. In the navigation bar for your repository, click **Settings**.\n2. In the \"Security\" section of the sidebar, click **Advanced Security**.\n3. Next to \"Dependabot version updates\", click **Enable**.\n\n## Next steps\n\nNow that you've tried out Dependabot and its features on a demo repository, **enable them on your own projects** to easily find, fix, and prevent dependency vulnerabilities."}