GitHub’s supply chain security features now support Dart
Cross-platform apps built with the popular Flutter toolkit can now benefit from Dependabot alerts.
What do applications like Google Ads, eBay Motors, and Alibaba Xianyu have in common? In addition to millions of monthly users, each was built with the popular Flutter framework that is powered by Dart. Given its rapid growth and broad adoption – and thanks to a collaboration with the Dart team at Google – GitHub supply chain security features now support the Dart developer ecosystem. This makes it easier for developers and security teams to visualize, maintain, and secure the dependencies in the Dart software supply chain.
We’re grateful to the folks at Google for their contributions here! To learn more about what this means to you as a developer, see Google’s blog post.
About supply chain security
If you’re new to supply chain security, read on for an overview of capabilities now available for Dart. GitHub also maintains documentation for those ready for a deeper dive.
Advisories
The GitHub Advisory Database is an open database of security advisories focused on high quality, actionable vulnerability information for developers. If you’re a Dart package maintainer, you can now use GitHub Security Advisories to collaborate with vulnerability reporters to privately discuss and fix vulnerabilities before announcing them publicly. Additionally, if you find a Dart vulnerability with a CVE that isn’t in the GitHub Advisory Database, you can report it through a community contribution.
Dependency graph
The dependency graph analyzes a repository’s pubspec.yaml
and pubspec.lock
files to determine the dependencies being used in your project. This serves as a backbone for Dependabot, which alerts you when there is a known vulnerability and creates pull requests to update the affected dependency. To view a repository’s detected dependencies, select the repository’s Insights tab, then select Dependency graph from the sidebar on the left.
The dependency graph is enabled by default for public repositories, but you must enable it for private repositories.
You can prevent Dart vulnerabilities from being introduced in the first place with the dependency review GitHub Action. This action scans pull requests for changes in your Dart dependencies and will raise an error for known vulnerabilities so you can keep them out of your code.
Dependabot alerts and security updates
Dependabot alerts notify you when new vulnerabilities are discovered in Dart packages you’re already using, and Dependabot security updates will create pull requests that automatically upgrade your vulnerable Dart packages to a version without the vulnerability. You can configure both Dependabot alerts and Dependabot security updates so you’re just getting the notifications and pull requests you want for your repository.
Secure your Dart repository
There’s a lot of functionality here! You can get started by securing your Dart repository, or learn more about each of GitHub’s supply chain security features:
- Security advisories
- Dependency graph
- Dependency review
- Dependabot alerts
- Dependabot security updates
Tags:
Written by
Related posts
The second half of software supply chain security on GitHub
Learn about a community-developed framework for how to think about this problem holistically and how to use GitHub, particularly, to improve the security in the second half of your software supply chain.
Cybersecurity spotlight on bug bounty researcher @imrerad
For this year’s Cybersecurity Awareness Month, the GitHub Bug Bounty team is excited to feature another spotlight on a talented security researcher who participates in the GitHub Security Bug Bounty Program—@imrerad!
Kicking off Cybersecurity Awareness Month: Researcher spotlights and additional incentives!
For this year’s Cybersecurity Awareness Month, GitHub’s Bug Bounty team is excited to offer some additional incentives to security researchers!