{"id":71146,"date":"2025-08-04T09:17:37","date_gmt":"2025-08-04T17:17:37","guid":{"rendered":"https:\/\/devblogs.microsoft.com\/devops\/?p=71146"},"modified":"2025-08-04T09:17:37","modified_gmt":"2025-08-04T17:17:37","slug":"automate-your-open-source-dependency-scanning-with-advanced-security","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/devops\/automate-your-open-source-dependency-scanning-with-advanced-security\/","title":{"rendered":"Automate your open-source dependency scanning with Advanced Security"},"content":{"rendered":"

Any experiences that require additional setup is cumbersome, especially when there are multiple people needed. In GitHub Advanced Security for Azure DevOps, we’re working to make it easier to enable features and<\/em> scale out enablement across your enterprise.<\/p>\n

You can now automatically inject the dependency scanning task into any pipeline run targeting your default branch. This is a quick way to ensure that your production code (and any code being merged into your production branch) are evaluated for open-source dependency vulnerabilities.<\/p>\n

Enabling one-click dependency scanning for your repository<\/h2>\n

You’ll need to have the Advanced Security: manage settings permission to make changes to your repository’s Advanced Security enablement. Navigate to a specific repository’s settings page: Project settings<\/strong> > Repositories<\/strong> > Select your repository.<\/p>\n

If you’re using the standalone products, you first need Code Security enabled. Then, navigate to Options<\/strong> and confirm your selection of Dependency alerts default setup<\/strong>.<\/p>\n

\"Advanced<\/a><\/p>\n

If you’re using the bundled Advanced Security, enable the checkbox to Scan default branch for vulnerable dependencies<\/strong>.<\/p>\n

\"Advanced<\/a><\/p>\n

Receiving results from dependency scanning<\/h2>\n

Upon the next execution of a pipeline run targeting your repository’s default branch, the Advanced Security dependency scanning task will be injected near the end of your pipeline. Dependency scanning completes evaluation of your dependencies and any associated vulnerabilities within a few minutes. For repositories where you may not have consistent CI\/CD running, we recommend scheduled pipeline runs.<\/p>\n

If the task is already in your pipeline or you’ve set up your pipelines to skip the dependency scanning task via the DependencyScanning.Skip: true<\/code> environment variable, the injected task will be skipped. The environment variable is a great option if there are certain pipelines you don’t want to include in your scanning surface area. Alternatively, if there are certain pipeline jobs you wish to skip automated scanning in, you can also set the pipeline variable dependencyScanningInjectionEnabled<\/code> to false.<\/p>\n

Upon successful execution of the task, results are uploaded to Advanced Security and available in the Repos<\/strong> > Advanced Security<\/strong> tab for developers to fix any findings.<\/p>\n

\"Advanced<\/a><\/p>\n

You can also use this to easily set up pull request annotations for dependency scanning. If you have a build validation policy configured for your repository, dependency scanning will also automatically inject into any pull requests that target your default branch. Annotations for new findings appear directly on your pull request after you’ve scanned your default branch at least once, while any findings that exist in both branches will show up in the Advanced Security tab as well.<\/p>\n

Next steps<\/h2>\n

Give this feature a try! Our team is also working on more experiences to smooth out the enablement process across Advanced Security. Have any feedback? Please share that with us directly or on Developer Community<\/a>.<\/p>\n

Learn more about Advanced Security<\/a> and dependency scanning<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"

Any experiences that require additional setup is cumbersome, especially when there are multiple people needed. In GitHub Advanced Security for Azure DevOps, we’re working to make it easier to enable features and scale out enablement across your enterprise. You can now automatically inject the dependency scanning task into any pipeline run targeting your default branch. […]<\/p>\n","protected":false},"author":177424,"featured_media":71181,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1,249,251],"tags":[],"class_list":["post-71146","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-devops","category-open-source","category-security"],"acf":[],"blog_post_summary":"

Any experiences that require additional setup is cumbersome, especially when there are multiple people needed. In GitHub Advanced Security for Azure DevOps, we’re working to make it easier to enable features and scale out enablement across your enterprise. You can now automatically inject the dependency scanning task into any pipeline run targeting your default branch. […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/devops\/wp-json\/wp\/v2\/posts\/71146","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/devops\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/devops\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/devops\/wp-json\/wp\/v2\/users\/177424"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/devops\/wp-json\/wp\/v2\/comments?post=71146"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/devops\/wp-json\/wp\/v2\/posts\/71146\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/devops\/wp-json\/wp\/v2\/media\/71181"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/devops\/wp-json\/wp\/v2\/media?parent=71146"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/devops\/wp-json\/wp\/v2\/categories?post=71146"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/devops\/wp-json\/wp\/v2\/tags?post=71146"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}