Merge pull request #45084 from github/repo-sync

Repo sync

Author: docs-bot

content/code-security/concepts/supply-chain-security/dependabot-alerts.md

@@ -28,7 +28,8 @@ Software often relies on packages from various sources, creating dependency rela
 
 {% ifversion fpt or ghec %}
 * A new vulnerability is added to the {% data variables.product.prodname_advisory_database %}{% else %}
-* New advisory data is synchronized to {% data variables.product.prodname_dotcom %} each hour from {% data variables.product.prodname_dotcom_the_website %}. {% data reusables.security-advisory.link-browsing-advisory-db %}{% endif %}
+* New advisory data is synchronized to {% data variables.product.prodname_dotcom %} each hour from {% data variables.product.prodname_dotcom_the_website %}. {% data reusables.security-advisory.link-browsing-advisory-db %}{% endif %}{% ifversion ghec %}
+* Your enterprise publishes an innersource advisory for a component you depend on. For more information, see [AUTOTITLE](/code-security/concepts/vulnerability-reporting-and-management/innersource-advisories).{% endif %}
 * Your dependency graph changes—for example, when you push commits that update packages or versions
 
 For supported ecosystems, see [AUTOTITLE](/code-security/supply-chain-security/understanding-your-software-supply-chain/dependency-graph-supported-package-ecosystems#supported-package-ecosystems).
@@ -41,7 +42,9 @@ When {% data variables.product.github %} detects a vulnerable dependency, a {% d
 * Details about the vulnerability and its severity
 * Information about a fixed version (when available)
 
-For information about viewing and managing alerts, see [AUTOTITLE](/code-security/dependabot/dependabot-alerts/viewing-and-updating-dependabot-alerts).
+{% ifversion ghec %}Alerts generated from an innersource advisory carry a distinct "Innersource" label, distinguishing them from alerts based on public advisories.
+
+{% endif %}For information about viewing and managing alerts, see [AUTOTITLE](/code-security/dependabot/dependabot-alerts/viewing-and-updating-dependabot-alerts).
 
 ## Who can enable alerts?
 
@@ -102,7 +105,7 @@ Alternatively, you can opt into the weekly email digest, or even completely turn
 
 * Alerts can't catch every security issue. Always review your dependencies and keep manifest and lock files up to date for accurate detection.
 * New vulnerabilities may take time to appear in the {% data variables.product.prodname_advisory_database %} and trigger alerts.
-* Only advisories reviewed by {% data variables.product.github %} trigger alerts.
+* Only advisories reviewed by {% data variables.product.github %}{% ifversion ghec %} or published by your enterprise as innersource advisories{% endif %} trigger alerts.
 * {% data variables.product.prodname_dependabot %} doesn't scan archived repositories.{% ifversion dependabot-malware-alerts %}{% else %}
 * {% data variables.product.prodname_dependabot %} doesn't generate alerts for malware.{% endif %}
 * {% data reusables.dependabot.dependabot-alert-actions-semver %}
@@ -120,7 +123,8 @@ With a {% data variables.copilot.copilot_enterprise %} license, you can ask {% d
 ## Further reading
 
 {% ifversion dependabot-malware-alerts %}
-* [AUTOTITLE](/code-security/concepts/supply-chain-security/dependabot-malware-alerts){% endif %}
+* [AUTOTITLE](/code-security/concepts/supply-chain-security/dependabot-malware-alerts){% endif %}{% ifversion ghec %}
+* [AUTOTITLE](/code-security/concepts/vulnerability-reporting-and-management/innersource-advisories){% endif %}
 * [AUTOTITLE](/code-security/dependabot/dependabot-alerts/viewing-and-updating-dependabot-alerts)
 * [AUTOTITLE](/code-security/dependabot/dependabot-security-updates/about-dependabot-security-updates)
 * [AUTOTITLE](/code-security/getting-started/auditing-security-alerts)

content/code-security/concepts/vulnerability-reporting-and-management/github-advisory-database.md

@@ -1,6 +1,6 @@
 ---
 title: GitHub Advisory database
-intro: 'The {% data variables.product.prodname_advisory_database %} contains a list of known security vulnerabilities and malware, grouped in three categories: {% data variables.product.company_short %}-reviewed advisories, unreviewed advisories, and malware advisories.'
+intro: 'Research known security vulnerabilities and malware in open source packages, so you can understand and remediate the risks in your dependencies.'
 versions:
   fpt: '*'
   ghec: '*'
@@ -17,19 +17,25 @@ category:
 
 ## About the {% data variables.product.prodname_advisory_database %}
 
-{% data reusables.repositories.tracks-vulnerabilities %}
-
 Security advisories are published as JSON files in the Open Source Vulnerability (OSV) format. For more information about the OSV format, see [Open Source Vulnerability format](https://ossf.github.io/osv-schema/).
 
 ## Types of security advisories
 
-Each advisory in the {% data variables.product.prodname_advisory_database %} is for a vulnerability in open source projects or for malicious open source software.
+Each advisory in the {% data variables.product.prodname_advisory_database %} relates to a specific security problem in a software component. These problems come in several varieties.
+
+A vulnerability is a problem in a project's code that could be exploited to damage the confidentiality, integrity, or availability of the project or other projects that use it. Vulnerabilities in code are usually introduced by accident and fixed soon after they are discovered. Vulnerability advisories contain information about the range of released package versions where the problem exists, and the earliest version where the problem was fixed. This helps downstream users of the software address the vulnerability by updating their dependencies to use a fixed version as soon as it is available.
+
+In contrast, malicious software, or malware, is code that is intentionally designed to perform unwanted or harmful functions. The malware may target hardware, software, confidential data, or users of any application that uses the malware. You need to remove the malware from your project and find an alternative, more secure replacement for the dependency. Malware alerts do not contain a fix version, because the defining characteristic of a malware alert is that there are no safe versions—the only safe course of action is not to use the package at all.
 
-{% data reusables.repositories.a-vulnerability-is %} Vulnerabilities in code are usually introduced by accident and fixed soon after they are discovered. You should update your code to use the fixed version of the dependency as soon as it is available.
+{% ifversion ghec %}
 
-In contrast, malicious software, or malware, is code that is intentionally designed to perform unwanted or harmful functions. The malware may target hardware, software, confidential data, or users of any application that uses the malware. You need to remove the malware from your project and find an alternative, more secure replacement for the dependency.
+Both of these advisory types are public information about open source packages. Users with {% data variables.product.prodname_GH_code_security %} or {% data variables.product.prodname_GHAS %} can also create innersource advisories, which restrict visibility to just their organization or enterprise. Innersource advisories use the same OSV format as public advisories but can be associated with either public or internal, private projects. This allows enterprises to use the familiar {% data variables.product.prodname_dependabot %} alert and update features to provide fixes to internal software consumers. For more information about innersource advisories, see [AUTOTITLE](/code-security/concepts/vulnerability-reporting-and-management/innersource-advisories).
 
-### {% data variables.product.company_short %}-reviewed advisories
+{% endif %}
+
+### {% data variables.product.company_short %}-reviewed vulnerability advisories
+
+{% data reusables.repositories.tracks-vulnerabilities %}
 
 {% data reusables.advisory-database.github-reviewed-overview %}
 
@@ -52,7 +58,7 @@ If you have a suggestion for a new ecosystem we should support, please open an [
 
 If you enable {% data variables.product.prodname_dependabot_alerts %} for your repositories, you are automatically notified when a new {% data variables.product.company_short %}-reviewed advisory reports a vulnerability for a package you depend on. For more information, see [AUTOTITLE](/code-security/dependabot/dependabot-alerts/about-dependabot-alerts).
 
-### Unreviewed advisories
+### Unreviewed vulnerability advisories
 
 {% data reusables.advisory-database.unreviewed-overview %}
 
@@ -64,7 +70,7 @@ If you enable {% data variables.product.prodname_dependabot_alerts %} for your r
 
 {% data variables.product.prodname_dependabot %} doesn't generate alerts when malware is detected as most of the vulnerabilities cannot be resolved by downstream users. You can view malware advisories by searching for `type:malware` in the {% data variables.product.prodname_advisory_database %}.
 
-Our malware advisories are mostly about substitution attacks. During this type of attack, an attacker publishes a package to the public registry with the same name as a dependency that users rely on from a third party or private registry, with the hope that the malicious version is consumed. {% data variables.product.prodname_dependabot %} doesn’t look at project configurations to determine if the packages are coming from a private registry, so we aren't sure if you're using the malicious version or a non-malicious version. Users who have their dependencies appropriately scoped should not be affected by malware.
+Our malware advisories are mostly about substitution attacks. During this type of attack, an attacker publishes a package to the public registry with the same name as a dependency that users rely on from a third party or private registry, with the hope that the malicious version is consumed. {% data variables.product.prodname_dependabot %} doesn't look at project configurations to determine if the packages are coming from a private registry, so we can't determine whether you're using the malicious version or a non-malicious version that has the same name. Users who have their dependencies appropriately scoped should not be affected by malware.
 
 ## Information in security advisories
 

content/code-security/concepts/vulnerability-reporting-and-management/index.md

@@ -8,6 +8,7 @@ versions:
 contentType: concepts
 children:
   - /github-advisory-database
+  - /innersource-advisories
   - /repository-security-advisories
   - /global-security-advisories
   - /coordinated-disclosure

content/code-security/concepts/vulnerability-reporting-and-management/innersource-advisories.md

@@ -0,0 +1,30 @@
+---
+title: Innersource advisories
+shortTitle: Innersource advisories
+intro: Enterprises can alert their internal repositories to vulnerabilities and ship automated fixes with {% data variables.product.prodname_dependabot %}, using advisories that stay private to a single enterprise.
+versions:
+  fpt: '*'
+  ghec: '*'
+contentType: concepts
+category:
+  - Secure your dependencies
+---
+
+## About innersource advisories
+
+The {% data variables.product.prodname_advisory_database %} provides a centralized source of alert information for security vulnerabilities. When an advisory about a vulnerable open source component is published, {% data variables.product.prodname_dependabot %} uses {% data variables.product.company_short %}'s dependency graph to find repositories that are using that component, then sends alerts and pull requests to notify the repository's owners and update the affected code to a newer version that fixes the vulnerability.
+
+Enterprises can use the same mechanism to create alerts and send updates about internally discovered vulnerabilities. Innersource advisories use a similar Open Source Vulnerability (OSV) data format to public advisories, but are not publicly visible. They are scoped to a single enterprise and therefore only propagate alerts to repositories inside that enterprise. The subject of an innersource advisory can be either an internal or open source component, enabling enterprises to push fixes independent of public disclosure and alerting.
+
+## Who can create innersource advisories
+
+Innersource advisories can only be created in enterprises that have an active {% data variables.product.prodname_GH_code_security %} or {% data variables.product.prodname_GHAS %} license. If your license expires or {% data variables.product.prodname_GH_code_security %} is disabled, advisories will no longer be visible and will not propagate alerts. However, the underlying data will not be deleted, and re-activating the license will restore any pre-existing advisories.
+
+## Limitations of innersource advisories
+
+* Currently, advisories can only be scoped to an entire enterprise. You cannot target individual organizations or groups of organizations inside the enterprise.
+* Each enterprise is limited to 2,000 active advisories. Attempts to create new advisories once that limit is reached will result in an error. If you reach this limit, you can withdraw old or outdated advisories. See [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/manage-innersource-advisories#withdrawing-innersource-advisories).
+
+## Next steps
+
+To create, distribute, and withdraw innersource advisories, see [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/manage-innersource-advisories).

content/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/index.md

@@ -12,6 +12,7 @@ children:
   - /configure-malware-alerts
   - /configure-security-updates
   - /configure-version-updates
+  - /manage-innersource-advisories
   - /auto-update-actions
   - /configuring-multi-ecosystem-updates
   - /enable-dependency-graph