Innersource advisories: enterprise visibility and dependency remediation

The news at the time

GitHub announced generally available internal security advisories for Advanced Security enterprise customers. Unlike public open-source advisories, their visibility is restricted to repositories owned by that enterprise.

The REST API supports creating, updating and withdrawing innersource vulnerabilities. After an advisory is created, Dependabot can notify internal repositories using the component and open an upgrade pull request when a fixed version is needed.

Follow-up checked during renewal

No additional follow-up fact was established in this renewal. This does not establish that nothing changed.

What to review before applying this

Verify enterprise ownership, component identity and dependency matching before rollout. An advisory or generated pull request does not itself deploy a fix; preserve review, testing and release controls.

Editorial review suggestions; no hands-on product experiment was performed.