Skip to main content
This guide shows how to enable Dependabot via GitHub Advanced Security (GHAS) at the enterprise level, validate the configuration in a repository, and inspect/remediate dependency vulnerabilities using the dependency graph and Dependabot alerts. I’m signed in to the Enterprise Settings page as an admin and will configure Dependabot from the Advanced Security area.
A dark-themed screenshot of the GitHub Enterprise "Advanced Security" settings page for an organization called "NextGen Gaming." It displays security metrics (Dependabot 100%, Code Security 0%, Secret Protection 100%), configuration options, and a left-hand settings menu.
Steps I applied at the enterprise level:
  • Enabled the Dependency graph to allow GitHub to analyze dependency manifests and lockfiles.
  • Disabled Automatic dependency submission for now (you can enable this if you want automatic PRs to update manifests).
  • Enabled Dependabot alerts so maintainers see detected vulnerabilities.
  • Enabled Security updates so GitHub can propose fixes via pull requests; left repo-level overrides as Not set to let repository owners decide.
  • Enabled direct alert dismissal and turned on alerts for detected malware.
Here are the settings UI elements I changed.
A dark-themed screenshot of a GitHub enterprise security settings page showing Code scanning and Dependency scanning options with toggles for features like Automatic dependency submission, Dependabot alerts, and security updates (Enabled/Disabled). The lower part of the page also shows sections for private vulnerability reporting and policy settings.
These enterprise-level settings were saved and applied to the mapped repositories (three repos in this demo). Next, I opened the GHAS repository inside the Game Dev Studio organization and refreshed the repository’s Advanced Security page to confirm the settings.
Enterprise-level security settings (like enabling the dependency graph or Dependabot alerts) propagate to mapped repositories and cannot be overridden at the repository level when enforced by the enterprise. Review enterprise policy before changing these settings.
How to validate the configuration
  • Confirm the repository has the Dependency graph enabled. When enabled, GitHub parses manifest files and lockfiles to build a precise dependency tree and identify known vulnerabilities across supported ecosystems.
  • Check the repository’s Security settings to confirm Dependabot alerts and security updates are enabled.
Supported manifest and lockfile examples Dependency graph behavior
  • The Dependency graph lists all packages found in manifests (and lockfiles when present).
  • For each package, GitHub surfaces known security advisories and links to vulnerability details and remediation guidance.
Example: the repository’s package.json
The dependency graph for this repository surfaces multiple vulnerabilities (e.g., critical in mongoose, high in lodash) and allows clicking a package to view details or navigate to the package repository.
A screenshot of a GitHub repository's "Dependency graph" page in dark mode, showing a list of npm dependencies (mongoose, lodash, chai, express, etc.) with security severity badges and a left-side navigation menu.
Dependabot alerts and Security & analysis settings
  • With Dependabot alerts enabled, the repository exposes a list of open dependency vulnerabilities under Security → Dependabot alerts.
  • You can filter by CVE, manifest, ecosystem, severity, and more to prioritize triage.
A dark-mode screenshot of a GitHub repository's "Security and quality" settings page (game-devstudio/ghas-guardrail-demo) showing an overview list of security features and their statuses (e.g., Security policy disabled, Security advisories enabled, Dependabot alerts enabled, code scanning needs setup).
Viewing and triaging Dependabot alerts
A screenshot of a GitHub repository’s "Security and quality" → Dependabot alerts page showing a list of open dependency vulnerabilities (lodash, mongoose, etc.) with severity badges and a severity filter menu.
  • Click any alert to see: affected versions, severity, CVE (if assigned), detailed description, and remediation suggestions.
  • Typical remediation advice is to upgrade to the minimum patched version or a later compatible release.
Example remediation for mongoose (update package.json to the patched range):
Ways to remediate Dependabot alerts
  1. Manual update
    • Edit the manifest (e.g., package.json) to the recommended version.
    • Run your package manager (npm install or yarn install).
    • Run your test suite and CI.
    • Open a pull request with the changes.
  2. Automated updates via Security updates
    • Enable Security updates / Dependabot automated security fixes so GitHub opens a pull request automatically with the fix.
    • Review the incoming PR, run CI, and merge when green.
Keep repository tests and CI green before merging dependency updates. Automated pull requests speed remediation, but you should validate changes in your CI pipeline and run local tests where appropriate.
Summary
  • Enable the Dependency graph and Dependabot alerts (and optionally Security updates) at the enterprise level to ensure consistent detection and remediation workflows across repos.
  • Use the Dependency graph to inspect dependency trees and find vulnerable packages.
  • Triage and remediate using Dependabot alerts—either manually or by enabling automated security fixes.
Links and references

Watch Video