GHAS Supply Chain Security Lab

⚠️ Training only - intentionally outdated dependencies

The manifests here pin deliberately outdated dependencies so Dependabot has something to alert on. Do not deploy. Bump them as part of the labs.

Focused practice for GH-500 domain 3.0 - Configure and manage dependency alerts and review (the newer "Supply Chain Security"), by Certy.

What is here

• node-app/ - package.json with an outdated lodash.
• python-app/ - requirements.txt with an outdated requests.
• .github/dependabot.yml - alerts and updates for npm and pip.
• .github/workflows/:
  • dependency-review.yml - blocks PRs that add high-severity dependencies.
  • dependency-audit.yml - runs npm audit and pip-audit on a schedule.
• policies/ and docs/ - update policy, severity policy, risk register, triage.

How to use

1. Click Use this template, make it public, clone it.
2. Enable Dependabot alerts and security updates in Settings > Code security.
3. Work through labs/: review the alerts, merge the Dependabot pull requests, configure version updates, and write a remediation plan.

Key ideas

• Dependabot alerts detect vulnerable dependencies from the dependency graph.
• Dependabot security updates open PRs to fix vulnerable versions.
• Dependabot version updates keep dependencies current via dependabot.yml.
• Dependency review checks dependency changes in a pull request before merge.
• Transitive dependencies can be vulnerable even when your direct ones are fine.

Links

• Free GH-500 course and mock exam: https://certy.pro
• Course content: https://github.com/CertyPro/certy-ghas-course-content

Licence

MIT.