{"meta":{"title":"Dependabot auto-triage rules","intro":"Control how Dependabot handles security alerts, including filtering, ignoring, snoozing, or triggering security updates.","product":"Security and code quality","breadcrumbs":[{"href":"/en/code-security","title":"Security and code quality"},{"href":"/en/code-security/concepts","title":"Concepts"},{"href":"/en/code-security/concepts/supply-chain-security","title":"Supply chain security"},{"href":"/en/code-security/concepts/supply-chain-security/dependabot-auto-triage-rules","title":"Dependabot auto-triage rules"}],"documentType":"article"},"body":"# Dependabot auto-triage rules\n\nControl how Dependabot handles security alerts, including filtering, ignoring, snoozing, or triggering security updates.\n\n## About Dependabot auto-triage rules\n\nDependabot auto-triage rules allow you to instruct Dependabot to automatically triage Dependabot alerts and Dependabot malware alerts. You can use auto-triage rules to:\n\n* Automatically dismiss or snooze certain alerts\n* Specify the Dependabot alerts you want Dependabot to open pull requests for\n\nRules are applied before alert notifications are sent, so enabling rules that auto-dismiss low-risk alerts will help reduce notification noise.\n\nThere are two types of Dependabot auto-triage rules:\n\n* GitHub presets\n* Custom auto-triage rules\n\n### About GitHub presets\n\nGitHub presets are rules curated by GitHub that are available for all repositories.\n\n#### Dismiss low impact issues for development-scoped dependencies\n\nThe `Dismiss low impact issues for development-scoped dependencies` rule is a GitHub preset that auto-dismisses certain types of vulnerabilities that are found in npm dependencies used in development. These alerts cover cases that feel like false alarms to most developers as the associated vulnerabilities:\n\n* Are unlikely to be exploitable in a developer (non-production or runtime) environment.\n* May relate to resource management, programming and logic, and information disclosure issues.\n* At worst, have limited effects like slow builds or long-running tests.\n* Are not indicative of issues in production.\n\nThe rule is enabled by default for public repositories and can be opted into for private repositories. For instructions, see [Enabling the `Dismiss low impact issues for development-scoped dependencies` rule for your private repository](/en/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/prioritize-with-preset-rules#enabling-github-preset-rules).\n\nFor more information about the criteria used by the rule, see [CWEs used by GitHub's preset Dependabot rules](/en/code-security/reference/supply-chain-security/criteria-for-preset-rules).\n\n#### Dismiss package malware alerts\n\nThe `Dismiss package malware alerts` rule is a GitHub preset that auto-dismisses alerts that flag all versions of a package as malicious. If your project depends on an **internal** package with the same ecosystem and name as a malicious **public** package, Dependabot can generate a false positive alert, which the rule then auto-dismisses.\n\n> \\[!IMPORTANT]\n> Be aware that if a contributor adds a dependency that is truly malicious across all versions, this rule will auto-dismiss the related alert.\n\nThe `Dismiss package malware alerts` rule is disabled by default, but can be enabled for any repository using Dependabot malware alerts.\n\n### About custom auto-triage rules\n\n> \\[!NOTE]\n>\n> Custom auto-triage rules for Dependabot alerts are available on public repositories and on any organization-owned repositories in GitHub Team with [GitHub Code Security](/en/get-started/learning-about-github/about-github-advanced-security) enabled.\n\nWith custom auto-triage rules, you can create your own rules to automatically dismiss or reopen alerts based on targeted metadata, such as severity, package name, CWE, and more. You can also specify which Dependabot alerts you want Dependabot to open pull requests for. For more information, see [Customizing auto-triage rules to prioritize Dependabot alerts](/en/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/auto-triage-dependabot-alerts).\n\nYou can create custom rules from the **Settings** tab of the repository, provided the repository belongs to an organization that has a license for GitHub Code Security or GitHub Advanced Security. For more information, see [Adding custom auto-triage rules to your repository](/en/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/auto-triage-dependabot-alerts#adding-custom-auto-triage-rules-to-your-repository).\n\n### About auto-dismissing alerts\n\nWhilst you may find it useful to use auto-triage rules to auto-dismiss alerts, you can still reopen auto-dismissed alerts and filter to see which alerts have been auto-dismissed. For more information, see [Managing alerts that have been automatically dismissed by a Dependabot auto-triage rule](/en/code-security/how-tos/manage-security-alerts/manage-dependabot-alerts/managing-automatically-dismissed-alerts).\n\nAdditionally, auto-dismissed alerts are still available for reporting and reviewing, and can be auto-reopened if the alert metadata changes, for example:\n\n* If you change the scope of a dependency from development to production.\n* If GitHub modifies certain metadata for the related advisory.\n\nAuto-dismissed alerts are defined by the `resolution:auto-dismiss` close reason. Automatic dismissal activity is included in alert webhooks, REST and GraphQL APIs, and the audit log. For more information, see [REST API endpoints for Dependabot alerts](/en/rest/dependabot/alerts), and the \"`repository_vulnerability_alert`\" section in [Reviewing the audit log for your organization](/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization).\n\n## Next steps\n\nTo get started with Dependabot auto-triage rules, see [Using GitHub preset rules to prioritize Dependabot alerts](/en/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/prioritize-with-preset-rules).\n\nTo customize your auto-triage experience, see [Customizing auto-triage rules to prioritize Dependabot alerts](/en/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/auto-triage-dependabot-alerts)."}