Find and fix your first Dependabot alert

What are we building and why?

We are running GitHub's Dependabot teaching drill on a fork of a demo app that already contains insecure dependencies. The outcome is a merged security-update pull request that closes the hot-formula-parser alert, plus version updates enabled so Dependabot can keep proposing newer releases.

GitHub's Finding and fixing your first dependency vulnerability page is pure github.com UI. You navigate to new2code/dependabot-demo, click Fork → Create fork, open Security and quality, enable Dependabot alerts (confirming the dependency graph popup), enable Dependabot security updates, open the Dependabot sidebar alert Command Injection in hot-formula-parser, read the fix summary (upgrade to 3.0.1 in javascript/package-lock.json), click Review security update, review Files changed, merge and confirm, then enable Dependabot version updates under Settings → Advanced Security.

When we drilled this at ZeroShot Studio, the highest-value click was Review security update: people finally saw Dependabot's diff before merging. After we banned hand-rolled REST enable scripts for this lesson, teaching accounts stopped getting stuck on inventing PUT endpoints that the learning page never shows. The demo is intentionally insecure and not deployed, so there is no production blast radius while you learn the tabs.

Related reading: How to Reuse Other People's Code in Your Projects, How to Store Your Secrets Safely, and How to Find and Fix Your First Code Vulnerability. Authority: About Dependabot alerts, About Dependabot security updates, and About Dependabot version updates.

"While using dependencies is perfectly normal, dependencies can contain code vulnerabilities, which would in turn make your project insecure."

That is GitHub's framing. My rule of thumb at ZeroLabs: enable alerts and security updates first, read the alert body (or ask Copilot Chat if the advisory is dense), merge only after Files changed looks like the expected version bump, then turn on version updates so you are not only reactive.

flowchart TD
    Repo[Create dependabot-action from template] --> Enable[Enable Dependency Graph and Dependabot alerts]
    Enable --> Trigger[Push commit with outdated dependency]
    Trigger --> Alert[View alert in Security tab]
    Alert --> Review[Review advisory severity and fix summary]
    Review --> Update[Review automated Dependabot security PR]
    Update --> Merge[Merge update and verify alert resolution]

What are the required prerequisites?

Stay in the browser. The source page does not document gh repo fork, REST vulnerability-alerts, or gh pr merge for this exercise.

How do you implement the step-by-step recipe?

Follow GitHub's sections in order. Every control below is a UI label from the learning page.

1. Fork the demo repository. Open new2code/dependabot-demo. In the top right, click Fork. On the next page, click Create fork. You will not deploy this project; the insecure dependencies are safe for the exercise.

2. Enable Dependabot alerts and security updates. In your fork's navigation bar, click Security and quality. In the Dependabot alerts row, click Enable Dependabot alerts. In the Dependabot section, next to Dependabot alerts, click Enable. In the popup about enabling the dependency graph, read the statement, then click Enable. Next to Dependabot security updates, click Enable so Dependabot can open pull requests that fix vulnerabilities automatically.

3. Open the Dependabot alert list and pick the teaching alert. Click Security and quality again if you left the page. In the side navigation, click Dependabot. Click the alert title Command Injection in hot-formula-parser to open details.

4. Read the alert the way GitHub structures it.

   • Fix summary: Upgrading hot-formula-parser to version 3.0.1 fixes one alert identified in javascript/package-lock.json. When a fix PR exists, use the Review security update button.
   • Vulnerability details: Package name, vulnerable versions, fixed version, and how the issue can be exploited. In this alert, parse in hot-formula-parser does not properly validate user input before execution, which allows command injection.
   • Timeline: Starts with the timestamp Dependabot opened the alert; it gains a fix time after you merge.

   Tip from the docs: if the advisory text is unclear, ask Copilot Chat to explain it.

5. Apply the Dependabot security update. In the fix summary area, click Review security update. On the pull request, open Files changed and confirm Dependabot's version bump. Return via Conversation. At the bottom, click Merge pull request, then Confirm merge. When the PR merges, the linked Dependabot alert closes and the timeline records the fix time.

6. Enable Dependabot version updates for prevention. Open Settings on the fork. Under the Security section of the sidebar, click Advanced Security. Next to Dependabot version updates, click Enable. Dependabot can then open pull requests as new dependency versions ship, not only after a CVE alert.

How do you verify the deployment works?

What are the common production failure modes?

• Enabling alerts but skipping security updates: Cause: stopping after the first Enable. Fix: also enable Dependabot security updates so the Review security update PR can appear.
• Merging without reading Files changed: Cause: trusting the button alone. Fix: open Files changed, confirm the hot-formula-parser bump toward 3.0.1 in the lockfile, then merge.
• Looking for alerts under Code instead of Security: Cause: old navigation habits. Fix: repository Security and quality → sidebar Dependabot.
• Leaving version updates off: Cause: treating the single merged alert as permanent safety. Fix: Settings → Advanced Security → enable Dependabot version updates.
• Rewriting the drill as gh/REST: Cause: agent-oriented habits from other guides. Fix: this page's primary path is fork + Security tab + merge UI only.

FAQ

Is it safe to fork a repo that has known vulnerabilities? For this exercise, yes. GitHub states you will not deploy the demo, so there is no security risk in practicing on the fork.

What does the fix summary mean by upgrading to 3.0.1? Dependabot identified that moving hot-formula-parser to 3.0.1 closes the alert tied to javascript/package-lock.json. The security-update PR applies that change for you.

Why enable both security updates and version updates? Security updates open PRs for known vulnerable dependencies. Version updates open PRs as new versions release, which helps you stay current before the next advisory.

Do I need the GitHub CLI? Not for this learning page. Every required action is a github.com control: Fork, Security and quality, Dependabot, Review security update, Merge, Settings → Advanced Security.

What should I do after the demo? GitHub's next step is to enable the same Dependabot features on your own projects so you can find, fix, and prevent dependency vulnerabilities outside the teaching fork.