Dependency risk is growing faster than alert triage can keep up
The volume of newly published CVEs has climbed nearly 500% over the past decade, and even a project with only 10 direct dependencies can pull in hundreds of transitive ones. The result is a flood of dependency alerts that developers cannot realistically triage, let alone remediate in priority order.
High-profile supply chain incidents like the XZ Utils backdoor grab headlines, but they account for only a small slice of the actual threat surface. The more common danger is unpatched vulnerabilities hiding in lesser-known open source components.
To address this, GitHub has extended its Advanced Security and Dependabot offerings with Endor Labs software composition analysis (SCA). The integration is designed to help teams filter out low-risk noise and focus on vulnerabilities that are actually exploitable in their specific codebase, without leaving the GitHub workflow.
Applying reachability and exploitability context
Endor Labs SCA prioritizes dependency vulnerabilities by factors such as reachability and exploitability. Instead of flagging every vulnerable package version, it checks whether the vulnerable function is actually reachable from the application's code or merely sitting unused in a transitive dependency. Security teams can also set risk, licensing, and permission profiles so developers are only alerted when the risk genuinely warrants attention.
Teams that adopt the integrated tooling can dismiss up to 92% of low-risk dependency security alerts, according to GitHub, freeing developers to concentrate on the vulnerabilities that matter most.
Remediation options across the GitHub ecosystem
GitHub Advanced Security embeds core security practices into the development workflow. Its features, which include dependency review, secret scanning, code scanning, and Copilot Autofix, are free for open source maintainers.
Dependabot is available to all GitHub users at no cost and automates dependency updates. Developers fix vulnerabilities by merging Dependabot-authored pull requests or by applying Endor Patches directly.
Securing CI/CD automation itself
GitHub Actions simplifies automation of software workflows, from container builds to service deployments. Those actions require ongoing maintenance as they receive bug fixes and new features.
Endor Labs automatically discovers in-use actions and their dependencies to verify they conform to risk, licensing, and permission profiles. Dependabot handles dependency updates, while code scanning identifies existing workflow configuration vulnerabilities and helps prevent new ones from being introduced.
Teams can get started by signing up with Endor Labs and installing the Endor Labs GitHub App.
