Skip to content

The analyzer is capable of monitoring the evolution of vulnerable versions and distinguish the fixes done by the user from those carried out by Dependabot. It represents the first time when Dependabot has been objectively analyzed, it has allowed us to extract the weak points in which GitHub should work to achieve greater acceptance by users and…

License

Notifications You must be signed in to change notification settings

marisol-barrientos/dependabot_security_alerts_analysis

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

73 Commits
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

Dependabot Security Alerts Analyzer

The analyzer provides a workable way to see the evolution that the security alerts have had through the different commits of a GitHub repository. The source code is described in its wiki.

Setup

To work with the analyzer you have to download the full project and execute in the pip console the following commands:

pip install pandas
pip install influxdb
pip install influxdb-client
pip install pyyaml
pip install -U PyYAML

To learn more

If you want to know more about Dependabot Security Alerts Analyzer I recommend you to read my Bachelor thesis, you can find it here. Moreover, here are the results of the manual test performed.

About

The analyzer is capable of monitoring the evolution of vulnerable versions and distinguish the fixes done by the user from those carried out by Dependabot. It represents the first time when Dependabot has been objectively analyzed, it has allowed us to extract the weak points in which GitHub should work to achieve greater acceptance by users and…

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published