Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Bryan Dragon
A faster way to manage version updates with Dependabot
When the next Log4j lands, you don’t want to find out that you’re several versions behind, and that it’s going to take the team days to fix all of the breaking changes. Dependabot version updates automate the patching process, giving you a measure of protection from unwelcome surprises. But just as with any inbox, the sheer volume of available updates can quickly swell into a management hassle.
Dependabot relieves alert fatigue from npm devDependencies
Over the past few months, we’ve made a number of improvements that make Dependabot smarter, quieter, and easier to work with, from pausing pull requests on inactive repositories to making alerts visible to more developers. Today, we’re addressing the alert fatigue problem with a new allow auto-dismissal function in Dependabot that safely reduces the volume of false positive alerts that can overwhelm developers and distract from legitimate vulnerabilities.
How to mitigate OWASP vulnerabilities while staying in the flow
The pace and scale of security vulnerabilities is increasing. This is in spite of the fact that teams have been trying to keep their code secure for years. So, why are vulnerabilities still such a problem? When teams use security tools and strategies that don’t optimize the developer experience, development is slowed down. This creates frustration, undermines customer usability, and hampers business success.
Unlocking security updates for transitive dependencies with npm
A candidate completely botched his job interview just five minutes after entering the building where his interview was scheduled to take place. Reports indicate that a man was expected to interview for a client-facing job but was rejected before the interview started by failing a simple test at reception. [i] 1 DAY AGO
Unlocking security updates for transitive dependencies with npm
Dependabot helps developers secure their software with automated security updates: when a security advisory is published that affects a project dependency, Dependabot will try to submit a pull request that updates the vulnerable dependency to a safe version if one is available. Of course, there’s no rule that says a security vulnerability will only affect direct dependencies—dependencies at any level of a project’s dependency graph could become vulnerable.
5 tips for prioritizing Dependabot alerts
Dependabot alerts can give you a superpower–the ability to secure your project by keeping dependency-based vulnerabilities out of your code. However, while all potential vulnerabilities can be an issue and warrant attention, not all vulnerabilities pose equal risk to your project. For example, some vulnerabilities have the potential to be critical, but don’t pose as much risk due to how you’re using the dependency. So, how do you assess risk across all your alerts and prioritize accordingly?
Release Radar · June 2022 Edition
It’s been a crazy couple of months with the end of financial year and lots of products shipping. Our community has been hard at work shipping projects too. These projects can include everything from world-changing technology to developer tooling, and weekend hobbies. Here are some of these open source projects that released major updates this June. Read about these projects, and browse their repositories. There seems to be a bit of a Node.js theme this month.
Creating a more comprehensive dependency graph with build time detection
Understanding your dependencies is fundamental to good security practices. GitHub’s dependency graph detects your project’s dependencies and allows us to send Dependabot alerts when vulnerabilities are found in them. Until now, GitHub built the dependency graph entirely from static scans of checked-in manifest files. That limited the completeness of the graph in some ecosystems.
GitHub brings supply chain security features to the Rust community
GitHub’s supply chain security features help you understand what dependencies you use, be aware of vulnerabilities in those dependencies, and then patch them so you can get back to work. This helps keep your code secure. As the home for all developers, GitHub is enabling more projects to benefit from this functionality, and we now support the fastest growing language on GitHub: Rust.
Top games + source code from Gamedev.js Jam 2022
This is a guest post by GitHub Star, @end3r, a.k.a., Andrzej Mazur. Andrzej is a web game developer and technical evangelist, founder of Enclave Games indie studio, creator of the js13kGames competition, and Gamedev.js community firestarter—amongst other things! The recently-ended Gamedev.js Jam 2022 encouraged game developers to create web games and share their sources on GitHub. Let’s look at the best 13 entries and see what experts and other participants think of them.
Dependabot alerts now surface if your code is calling a vulnerability
Since our February ship of improvements to Dependabot alerts, Dependabot has helped developers resolve nearly 3 million alerts. Today, we’re shipping an exciting new feature which will make Dependabot alerts even more insightful. Dependabot alerts will now surface whether your code is calling vulnerable code paths, so that you can prioritize and remediate alerts more effectively.
Release Radar · March 2022 Edition
Each month, we highlight open source projects that have shipped major updates. These include everything from world-changing technology to developer tooling, and weekend projects. Here are our top staff picks on projects that shipped major version releases in March. Babylon.js 5.0 We featured Babylon.js in the November 2020 Release Radar. Since then, Babylon.js has come a long way. Many websites around the world are using this powerful web rendering engine.
Release Radar · February 2022 Edition
Each month, we like to highlight open source projects that have shipped major updates. These include everything, from world-changing technology, to developer tooling, and humanitarian projects. Here’s our top staff picks on projects that shipped major version releases this February. Ukraine Flag of Support Developers continued to band together in response to the war in Ukraine.
Improving the developer experience for Dependabot alerts
At GitHub, we believe in providing developer-first experiences to help you keep your code secure. Since we launched Dependabot alerts nearly four years ago, we’ve alerted users on over 425 million potential vulnerabilities in their open source dependencies. Today, we’re rolling out improvements to Dependabot alerts that make them easier to understand and remediate. What’s new More descriptive Dependabot alerts We’ve made it easier to quickly assess, prioritize, and act on Dependabot alerts.
Release Radar · November 2021 Edition
The end of the year is getting closer, and our communities are busy working away on their projects. While you’ve all been busy maintaining open source projects and shipping releases, we’ve created a new open source repository too! More about that at the end, but for now, let’s check out our top staff picks from open source projects that shipped major version releases during November. There’s everything here from huge open source projects, to weekend hobbies.
GitHub security update: Vulnerabilities in tar and @npmcli/arborist
Between July 21, 2021 and August 13, 2021 we received reports through one of our private security bug bounty programs from researchers regarding vulnerabilities in the Node.js packages tar and @npmcli/arborist. We started our own security review of tar and @npmcli/arborist during the triage of these issues, which in turn uncovered additional vulnerabilities.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Bryan
Contact Bryan, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack