GitHub’s supply chain security features now support Dart
Cross-platform apps built with the popular Flutter toolkit can now benefit from Dependabot alerts.
What do applications like Google Ads, eBay Motors, and Alibaba Xianyu have in common? In addition to millions of monthly users, each was built with the popular Flutter framework that is powered by Dart. Given its rapid growth and broad adoption – and thanks to a collaboration with the Dart team at Google – GitHub supply chain security features now support the Dart developer ecosystem. This makes it easier for developers and security teams to visualize, maintain, and secure the dependencies in the Dart software supply chain.
GitHub is used daily by hundreds of thousand Dart and Flutter developers building multi-platform apps. By collaborating with GitHub to add Dart to their supply chain security features, Dart developers now have new ways to find and fix issues before they impact their customers.
We’re grateful to the folks at Google for their contributions here! To learn more about what this means to you as a developer, see Google’s blog post.
About supply chain security
If you’re new to supply chain security, read on for an overview of capabilities now available for Dart. GitHub also maintains documentation for those ready for a deeper dive.
Advisories
The GitHub Advisory Database is an open database of security advisories focused on high quality, actionable vulnerability information for developers. If you’re a Dart package maintainer, you can now use GitHub Security Advisories to collaborate with vulnerability reporters to privately discuss and fix vulnerabilities before announcing them publicly. Additionally, if you find a Dart vulnerability with a CVE that isn’t in the GitHub Advisory Database, you can report it through a community contribution.
Dependency graph
The dependency graph analyzes a repository’s pubspec.yaml and pubspec.lock files to determine the dependencies being used in your project. This serves as a backbone for Dependabot, which alerts you when there is a known vulnerability and creates pull requests to update the affected dependency. To view a repository’s detected dependencies, select the repository’s Insights tab, then select Dependency graph from the sidebar on the left.
The dependency graph is enabled by default for public repositories, but you must enable it for private repositories.
You can prevent Dart vulnerabilities from being introduced in the first place with the dependency review GitHub Action. This action scans pull requests for changes in your Dart dependencies and will raise an error for known vulnerabilities so you can keep them out of your code.
Dependabot alerts and security updates
Dependabot alerts notify you when new vulnerabilities are discovered in Dart packages you’re already using, and Dependabot security updates will create pull requests that automatically upgrade your vulnerable Dart packages to a version without the vulnerability. You can configure both Dependabot alerts and Dependabot security updates so you’re just getting the notifications and pull requests you want for your repository.
Secure your Dart repository
There’s a lot of functionality here! You can get started by securing your Dart repository, or learn more about each of GitHub’s supply chain security features:
- Security advisories
- Dependency graph
- Dependency review
- Dependabot alerts
- Dependabot security updates
Tags:
Related posts
Execute commands by sending JSON? Learn how unsafe deserialization vulnerabilities work in Ruby projects
Can an attacker execute arbitrary commands on a remote server just by sending JSON? Yes, if the running code contains unsafe deserialization vulnerabilities. But how is that possible? In this blog post, we’ll describe how unsafe deserialization vulnerabilities work and how you can detect them in Ruby projects.
10 years of the GitHub Security Bug Bounty Program
Let’s take a look at 10 key moments from the first decade of the GitHub Security Bug Bounty program.
Where does your software (really) come from?
GitHub is working with the OSS community to bring new supply chain security capabilities to the platform.