ghas-dependabot

Dependabot Remediation

Overview

Upgrade vulnerable dependencies identified by Dependabot alerts. Prefer minimal version bumps, regenerate lock files, and verify no breaking changes.

Process

1. Fetch alert details: package name, current version, safe version, CVE, severity
2. Determine upgrade type: patch / minor / major
3. Apply upgrade:
   • If patch/minor → auto-upgrade
   • If major → check maxAutoFixMajorVersionBump config
     • If true → proceed with upgrade
     • If false → create Jira ticket, do NOT auto-upgrade
4. Update dependency file:
   • npm: update package.json, run npm install to regenerate package-lock.json
   • pip: update requirements.txt or pyproject.toml, run pip-compile if using pip-tools
   • Maven: update pom.xml version
   • Go: run go get package@version, then go mod tidy
   • NuGet: update .csproj PackageReference version, run dotnet restore
5. Run tests to verify no breaking changes
6. Resolve the alert via API if tests pass

Multi-Dependency Upgrades

When multiple dependencies need upgrading:

• Group by ecosystem (npm, pip, Maven, etc.)
• Upgrade one at a time, test after each
• If a single upgrade breaks tests, revert and create a Jira ticket for manual resolution