github / github/roadmap

npm package ecosystems now use Dependabot to generate dependency graphs [GA]

オープン
#1,245 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る
Enterprise Free GHES 3.23 GitHub Advanced Security (GHAS) Paused Team
主要言語
言語のデータがありません
スター
8.9k
フォーク
1.8k
PR マージ指標
30日以内にマージされた PR はありません

説明

### Value Prop

npm package ecosystems now use Dependabot to generate dependency graphs, replacing the previous static parsing mechanism. This means customers benefit from full transitive dependency coverage, accurate "dev dependency" labeling, and the ability to access npm packages in private registries through org-wide Dependabot secret configurations. Because the parser is part of the open-source dependabot-core community, customers also gain transparency into how their dependencies are resolved.

### Expected Outcome

By unifying npm dependency graph generation onto Dependabot's pipeline, we deliver a more accurate, complete, and configurable dependency analysis experience. Customers will see richer dependency graphs that include transitive dependencies and proper dev/production classification — improving their ability to assess supply chain risk. This also eliminates friction for teams using private npm registries, since existing Dependabot secret configurations now apply automatically.

コントリビューションガイド

コントリビューションガイドを開く

評価

この issue はまだ評価されていません。

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。