Microsoft's Azure DevOps Roadmap - Advanced Security + Dependabot

[Kevinf63]

Just want to get your thoughts on the following Microsoft roadmap?

We are bringing the power of Dependabot security updates to GitHub Advanced Security in Azure DevOps. This will allow Advanced Security users to enable the automatic creation of pull requests for dependency vulnerability detections.

Dependabot security updates will make it easier for you to fix vulnerable dependencies in your repository. Once you enable this feature, when a Dependabot alert is raised for a vulnerable dependency in your repository, Dependabot automatically tries to fix it.

Dependabot will check whether it's possible to upgrade the vulnerable dependency to a fixed version without disrupting the dependency graph for the repository. Then Dependabot will raise a pull request to update the dependency to the minimum version that includes the patch and links the pull request to the Dependency Scanning alert.

https://learn.microsoft.com/en-us/azure/devops/release-notes/roadmap/2024/ghazdo/dependabot

[mburumaxwell]

As per my understanding GitHub Advanced Security in Azure DevOps focuses on security vulnerabilities and not general updates. It is also a paid product (per committer, per month) just like it is on GitHub. https://azure.microsoft.com/en-gb/products/devops/github-advanced-security

I still haven't seen anything that points to Microsoft adding the general Dependabot functionality to Azure DevOps. As far as I know, a number of teams at Microsoft use the extension in this repository. I would use GHAS where cost budget is present but time budget is not, then use the extension for any other scenario.

Would this happen to be what you are looking for?

@rhyskoedijk would you happen to have a different opinion or something additional?

[rhyskoedijk]

That's my understanding too.
Until Microsoft signals that GHAS' Dependabot will allow you to manage all dependency updates, there is still a big gap this project fills. Even if/when that happens, there will still be users who want a free offering like what you get on GitHub.

I've noticed that the roadmap target has changed from "2024 Q2" to "Future", so I think it is reasonable to assume that this won't be GA in the next 12 months.

As far as I know, a number of teams at Microsoft use the extension in this repository

I've noticed this too