github
Advisory Database: GitHub Actions support
Summary
This release adds support for GitHub Actions as an ecosystem in the Advisory Database and will allow Dependabot to send alerts to users who have vulnerable dependencies in their GitHub Actions workflows.
Intended Outcome
GitHub Actions is being used on millions of repositories, and maintainers need an effective way to alert their users if they discover security vulnerabilities.
How will it work?
The Advisory Database has a list of known ecosystems. This feature will add GitHub Actions to that list, and add support for its specific version semantics.
🚢 This has shipped: https://github.blog/changelog/2022-08-09-advisory-database-supports-github-actions-advisories/
This went out with the GHES 3.7 release: https://docs.github.com/en/[email protected]/admin/release-notes