diff --git a/content/code-security/concepts/supply-chain-security/dependabot-security-updates.md b/content/code-security/concepts/supply-chain-security/dependabot-security-updates.md index bd474455dd51..ec15cee3b8e4 100644 --- a/content/code-security/concepts/supply-chain-security/dependabot-security-updates.md +++ b/content/code-security/concepts/supply-chain-security/dependabot-security-updates.md @@ -49,7 +49,13 @@ You can add a `dependabot.yml` configuration file to your repository to customiz The {% data variables.product.prodname_dependabot_security_updates %} feature is available for repositories where you have enabled the dependency graph and {% data variables.product.prodname_dependabot_alerts %}. You will see a {% data variables.product.prodname_dependabot %} alert for every vulnerable dependency identified in your full dependency graph. However, security updates are triggered only for dependencies that are specified in a manifest or lock file. For more information, see [AUTOTITLE](/code-security/concepts/supply-chain-security/dependency-graph). > [!NOTE] -> For npm, {% data variables.product.prodname_dependabot %} will raise a pull request to update an explicitly defined dependency to a secure version, even if it means updating the parent dependency or dependencies, or even removing a sub-dependency that is no longer needed by the parent. For other ecosystems, {% data variables.product.prodname_dependabot %} is unable to update an indirect or transitive dependency if it would also require an update to the parent dependency. For more information, see [AUTOTITLE](/code-security/reference/supply-chain-security/troubleshoot-dependabot/dependabot-errors#updates-dependencies-without-an-alert). +> {% data variables.product.prodname_dependabot %} can update an indirect (transitive) dependency to a secure version, but how it does so depends on your ecosystem: +> +> * **npm:** {% data variables.product.prodname_dependabot %} raises a pull request to update an explicitly defined dependency to a secure version. This may mean updating the parent dependency or dependencies, or removing a sub-dependency that the parent no longer needs. +> * **NuGet projects that use `PackageReference`:** {% data variables.product.prodname_dependabot %} tries to update the parent dependency to a version that resolves to a secure version of the transitive dependency. If no compatible parent update is available, it adds a direct reference that pins the transitive dependency to the secure version. +> * **Other ecosystems, and NuGet projects that use `packages.config`:** {% data variables.product.prodname_dependabot %} can't update an indirect or transitive dependency if doing so would also require updating the parent dependency. +> +> For more information, see [AUTOTITLE](/code-security/reference/supply-chain-security/troubleshoot-dependabot/dependabot-errors#updates-dependencies-without-an-alert). You can enable a related feature, {% data variables.product.prodname_dependabot_version_updates %}, so that {% data variables.product.prodname_dependabot %} raises pull requests to update the manifest to the latest version of the dependency, whenever it detects an outdated dependency. For more information, see [AUTOTITLE](/code-security/concepts/supply-chain-security/dependabot-version-updates). diff --git a/content/code-security/reference/supply-chain-security/troubleshoot-dependabot/dependabot-errors.md b/content/code-security/reference/supply-chain-security/troubleshoot-dependabot/dependabot-errors.md index 9e221577be40..8a3a51fbd9d8 100644 --- a/content/code-security/reference/supply-chain-security/troubleshoot-dependabot/dependabot-errors.md +++ b/content/code-security/reference/supply-chain-security/troubleshoot-dependabot/dependabot-errors.md @@ -70,7 +70,7 @@ Every application that has dependencies has a dependency graph, that is, a direc **Error message:** `{% data variables.product.prodname_dependabot %} tries to update dependencies without an alert` -{% data variables.product.prodname_dependabot %} updates explicitly defined transitive dependencies that are vulnerable for all ecosystems. For npm, {% data variables.product.prodname_dependabot %} will raise a pull request that also updates the parent dependency if it's the only way to fix the transitive dependency. +{% data variables.product.prodname_dependabot %} updates explicitly defined transitive dependencies that are vulnerable for all ecosystems. For npm, {% data variables.product.prodname_dependabot %} will raise a pull request that also updates the parent dependency if it's the only way to fix the transitive dependency. For NuGet projects that use `PackageReference`, {% data variables.product.prodname_dependabot %} first tries to update the parent dependency. If no compatible parent update is available, it adds a direct reference that pins the transitive dependency to the secure version. For example, a project with a dependency on `A` version `~2.0.0` which has a transitive dependency on `B` version `~1.0.0` which has resolved to `1.0.1`. diff --git a/content/integrations/how-tos/teams/integrate-github-with-teams.md b/content/integrations/how-tos/teams/integrate-github-with-teams.md index 9ebc94c7d877..248679c399c6 100644 --- a/content/integrations/how-tos/teams/integrate-github-with-teams.md +++ b/content/integrations/how-tos/teams/integrate-github-with-teams.md @@ -41,7 +41,6 @@ To use the {% data variables.product.github %} integration for Teams, you need: {% ifversion copilot %} -* You must have Microsoft Public Developer Preview enabled for your Microsoft Teams client, see [Public developer preview for Teams](https://learn.microsoft.com/en-us/microsoftteams/platform/resources/dev-preview/developer-preview-intro) in the Microsoft Learn documentation. {% data reusables.copilot.cloud-agent.cloud-sandboxes-prerequisite-teams %} ## Installing the {% data variables.product.github %} integration for Teams in a single workspace