Body
This KB article shows CAI app developers what to do when Dependabot finds a security vulnerability in one of your app's packages. Dependabot scanning is set up when a repo is created (see CAI EMPLOYEES: Creating a GitHub Repo for Your Replit App, Article ID 172317). Alerts arrive by email and are listed on the repo's Security tab.
New vulnerabilities are published every day and the alert informs you that Dependabot found a vulnerability. Frequently, it usually comes with a fix already drafted.
Prerequisite: you need admin access to the repo in the IT-Center-for-Artificial-Intelligence GitHub organization.
1. Open the alert list: in the repo, click Security (or Security and quality) → click View Dependabot alerts.
2. Each row is one vulnerability in one package. Read the row before acting. Two labels matter:
- Severity (Critical / High / Moderate / Low): how bad the flaw is in general.
- Development tag, if present: the package is a build-time tool that never runs in front of your users — the real-world risk is much lower than the severity label suggests. A green pull request number (like #3) at the end of a row means Dependabot has already drafted the fix. One pull request can fix multiple alerts at once.
3. If a fix is drafted (green PR number): click the Pull requests tab and open the pull request from dependabot. It only bumps package versions — nothing else. Scroll to the bottom of the Conversation tab and click Merge pull request, then Confirm merge.
4. If there is no PR: "No PR" doesn't necessarily mean no fix exists; sometimes Dependabot just hasn't drafted it yet. Click the alert's title to open it and look for the Patched version field near the bottom.
- Patched version listed: click the green Create Dependabot security update button on the alert page. Dependabot drafts the PR within a few minutes (refresh the page or check the Pull requests tab), then merge it as in step 3.
- Patched version: None: the package's maintainers haven't released a fix yet. There is nothing to install; leave the alert open. Dependabot will automatically draft the PR the day a patch ships and email you. If asked about it, the status is: "open, no patched version published yet, monitoring."
5. After merging, confirm the build: click the repo's Actions tab and watch the newest run. Yellow dot = building; green check = success; red X = failed (a failed build never deploys — the previous version keeps running; contact the app owner/AI assistant to investigate). A full run takes about 8 minutes.
6. Get the fix to the running app — this depends on where the app is hosted:
- Azure-hosted apps: nothing more to do — the green run in step 5 already deployed the fix to Azure automatically.
- Replit-hosted apps (not migrated to Azure): merging only fixed the repository. Open the project in Replit → Git pane → Pull, then republish the Replit deployment. Until you do both, the live app is still running the vulnerable version.
7. Sync Replit (all apps, including Azure-hosted): open the project in Replit → Git pane → Pull. One pull picks up all merges since the last one. Skipping this causes sync conflicts the next time you push from Replit.
8. Quick test: open the running app, sign in, and make sure it still works as expected.
9. If something does break after a merge: every merged pull request page has a Revert button — clicking it un-does that exact change and redeploys the previous state in one build (~8 minutes).
10. Confirm the alert closed: back on Security → Dependabot alerts, the fixed alert(s) should have moved to Closed on their own after the merge.