内部源安全通告正式全面上线
英文标题：Innersource security advisories are generally available
GitHub Advanced Security 企业客户现在可以发布仅限于企业内仓库可见的内部安全通告。新增的 REST API 端点支持创建、更新和撤销内部源漏洞，配合 Dependabot 自动向受影响仓库发送安全警报和版本更新通知，并在必要时自动发起 Pull Request 升级至修复版本。该功能让企业内部组件漏洞管理拥有了与开源安全通告一致的协作体验，提升了企业私密代码库的安全响应效率。
12.2 KB
127.0 KB
26.4 KB
中文
GitHub Advanced Security 企业客户现在可以发布内部安全通告。内部源通告的工作方式与 GitHub 的开源安全通告类似，但其可见性仅限于企业拥有的仓库。
新增了一个 REST API 端点，用于管理内部源漏洞，包括创建、更新或撤销漏洞的操作。当你通过 API 为某个组件创建通告后，GitHub 会利用 Dependabot 通知企业内使用该组件的仓库。通知可以包括安全警报和版本更新。当需要版本升级时，Dependabot 会发起一个 Pull Request，将存在漏洞的组件版本升级到包含修复的版本。更多信息请参阅创建和使用内部源通告。
English / 原文
GitHub Advanced Security enterprise customers can now publish internal security advisories. Innersource advisories work similarly to GitHub’s open source advisories, but their visibility is restricted to repositories owned by the enterprise.
There is a new REST API endpoint to manage innersource vulnerabilities, including operations to create, update, or withdraw vulnerabilities. Once you use the API to create an advisory about a component, GitHub uses Dependabot to notify repositories inside the enterprise that use the component. Notifications can include security alerts and version updates. When a version upgrade is needed, Dependabot will open a pull request to upgrade a vulnerable version of the component to one with a fix. For more information, see Creating and using innersource advisories.