Security update doesn't catch vulnerable packs

I’m trying trying to run Dependabot only for security updates, but looks like it doesn’t catch vulnerable packs. As example I used simple-git v3.5.0 (Snyk: simple-gi ) - which has been reported in my WhiteSource scan. To force security update I used: open-pull-requests-limit: 0 so I can see in the console:

Pull requests limit is set to zero. Security only updates are implied.
...
Checking if simple-git 3.5.0 is vulnerable
simple-git 3.5.0 i**s not vulnerable**

Any explanation why it doesn’t see this pack as vulnerable? Is there any other parameter that should be provided to support this type of update?

Used latest vesion of extension (0.14.1.420).

[mburumaxwell]

@BeataKr Checking for vulnerabilities in the GitHub GraphQL API requires authentication hence a GitHub access token must be supplied. This can only be done in the task using either gitHubConnection or gitHubAccessToken input.

For example:

steps:
- task: dependabot@1
  inputs:
    gitHubAccessToken: $(MyVeryPrivateGitHubPAT)

Create MyVeryPrivateGitHubPAT as a variable in the pipeline.

This should be a classic PAT with public_repo permission.

[mburumaxwell]

You are right. Having gitHubAccessToken resolves the problem - would be nice to see such information in documentation (regarding to security updates).

I’m glad your issue is resolved. You could contribute documentation similar to #483?