github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #5482] Enable Dependabot security alerts for GitHub Actions #3011

New issue

Open

opened 2026-05-05 09:39:48 -06:00 by gitea-mirror · 3 comments

gitea-mirror commented

2026-05-05 09:39:48 -06:00

Owner

Originally created by @kmk3 on GitHub (Nov 24, 2022).
Original GitHub issue: https://github.com/netblue30/firejail/issues/5482

Originally assigned to: @netblue30 on GitHub.

What

From https://github.blog/changelog/2022-11-23-dependabot-security-updates-now-supports-github-actions/:

Dependabot security updates now supports GitHub Actions

November 23, 2022

Dependabot security updates now supports the GitHub Actions ecosystem, making
it easier for you to fix vulnerable GitHub Actions dependencies. With
security updates enabled, Dependabot will automatically raise a pull request
to update vulnerable GitHub Actions used in your workflows to the minimum
patched version.

Learn more about Dependabot security updates.

How

Go to https://github.com/netblue30/firejail/settings/security_analysis

Enable the following items:

Dependabot alerts
Dependabot security updates

Relates to #4774.

Originally created by @kmk3 on GitHub (Nov 24, 2022). Original GitHub issue: https://github.com/netblue30/firejail/issues/5482 Originally assigned to: @netblue30 on GitHub. ### What From <https://github.blog/changelog/2022-11-23-dependabot-security-updates-now-supports-github-actions/>: > Dependabot security updates now supports GitHub Actions > > November 23, 2022 > > Dependabot security updates now supports the GitHub Actions ecosystem, making > it easier for you to fix vulnerable GitHub Actions dependencies. With > security updates enabled, Dependabot will automatically raise a pull request > to update vulnerable GitHub Actions used in your workflows to the minimum > patched version. > > [Learn more about Dependabot security updates][1]. [1]: https://docs.github.com/en/code-security/dependabot/dependabot-security-updates/about-dependabot-security-updates ### How Go to <https://github.com/netblue30/firejail/settings/security_analysis> Enable the following items: * Dependabot alerts * Dependabot security updates --- Relates to #4774.

gitea-mirror added the

enhancement

label 2026-05-05 09:39:48 -06:00

gitea-mirror commented

2026-05-05 09:39:50 -06:00

Author

Owner

@rusty-snake commented on GitHub (Nov 25, 2022):

Dependabot updates are already enabled a92d573266/.github/dependabot.yml

@rusty-snake commented on GitHub (Nov 25, 2022): Dependabot updates are already enabled https://github.com/netblue30/firejail/blob/a92d573266a87b212c630b1fe01ea06861e77bc8/.github/dependabot.yml

gitea-mirror commented

2026-05-05 09:39:51 -06:00

Author

Owner

@kmk3 commented on GitHub (Nov 25, 2022):

@rusty-snake commented on Nov 25:

Dependabot updates are already enabled
a92d573266/.github/dependabot.yml

Note that this is a third, separate option called "Dependabot version updates".
Here is the full list for reference:

Dependabot

Keep your dependencies secure and up-to-date. Learn more about
Dependabot.

Dependabot alerts

Receive alerts for vulnerabilities that affect your dependencies and
manually generate Dependabot pull requests to resolve these
vulnerabilities. Configure alert notifications.

Dependabot security updates

Allow Dependabot to open pull requests automatically to resolve Dependabot
alerts.

Dependabot version updates

Allow Dependabot to open pull requests automatically to keep your
dependencies up-to-date when new versions are available. Learn more about
configuring a dependabot.yml file.

You can check this on a personal project at
$project_url/settings/security_analysis.

@kmk3 commented on GitHub (Nov 25, 2022): @rusty-snake commented [on Nov 25](https://github.com/netblue30/firejail/issues/5482#issuecomment-1327681305): > Dependabot updates are already enabled > https://github.com/netblue30/firejail/blob/a92d573266a87b212c630b1fe01ea06861e77bc8/.github/dependabot.yml Note that this is a third, separate option called "Dependabot version updates". Here is the full list for reference: > __Dependabot__ > > Keep your dependencies secure and up-to-date. [Learn more about > Dependabot][1]. > > * [ ] __Dependabot alerts__ > > Receive alerts for vulnerabilities that affect your dependencies and > manually generate Dependabot pull requests to resolve these > vulnerabilities. [Configure alert notifications][2]. > > * [ ] __Dependabot security updates__ > > Allow Dependabot to open pull requests automatically to resolve Dependabot > alerts. > > * [ ] __Dependabot version updates__ > > Allow Dependabot to open pull requests automatically to keep your > dependencies up-to-date when new versions are available. [Learn more about > configuring a dependabot.yml file][3]. [1]: https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-supply-chain-security#what-is-dependabot [2]: https://github.com/settings/notifications#vulnerability-alerts-heading [3]: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuring-dependabot-version-updates You can check this on a personal project at `$project_url/settings/security_analysis`.

gitea-mirror commented

2026-05-05 09:39:52 -06:00

Author

Owner

@kmk3 commented on GitHub (Nov 25, 2022):

To clarify, currently the update interval is fixed at once per week and does
not take into account security advisories.

Enabling this should result in dependabot opening PRs for security
vulnerabilities in GitHub Actions quicker than that; presumably soon after they
are published as a GitHub Advisory.

And so the frequency of non-security-related PRs could then perhaps be
decreased without necessarily increasing the risks by a significant margin.

@kmk3 commented on GitHub (Nov 25, 2022): To clarify, currently the update interval is fixed at once per week and does not take into account security advisories. Enabling this should result in dependabot opening PRs for security vulnerabilities in GitHub Actions quicker than that; presumably soon after they are published as a GitHub Advisory. And so the frequency of non-security-related PRs could then perhaps be decreased without necessarily increasing the risks by a significant margin.

gitea-mirror referenced this issue

2026-05-05 10:23:23 -06:00

[PR #3011] [MERGED] Add Comment Mentioning that nodbus Breaks Native Notifications #4612

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#3011

No description provided.

Rows
Columns