|
| 1 | +--- |
| 2 | +title: Security advisories |
| 3 | +description: >- |
| 4 | + Use security advisories to inform and be informed |
| 5 | + about security vulnerabilities in Dart packages. |
| 6 | +--- |
| 7 | + |
| 8 | +Security advisories are a means to report information about security |
| 9 | +vulnerabilities. Pub uses the [GitHub Advisory Database][] |
| 10 | +for publishing security advisories for Dart and Flutter packages. |
| 11 | + |
| 12 | +To create an advisory in your GitHub repository, use |
| 13 | +GitHub's security advisory reporting mechanism as |
| 14 | +explained in GitHub's docs on [Creating a repository security advisory][]. |
| 15 | +First you create a draft security advisory, which will then be reviewed by |
| 16 | +GitHub and ingested into the central advisory database. |
| 17 | + |
| 18 | +[GitHub Advisory Database]: https://github.com/advisories |
| 19 | +[Creating a repository security advisory]: https://docs.github.com/code-security/security-advisories/working-with-repository-security-advisories/creating-a-repository-security-advisory |
| 20 | + |
| 21 | +## Security advisories in the pub client |
| 22 | + |
| 23 | +The pub client surfaces security advisories at dependency resolution. |
| 24 | +For instance, when running `dart pub get` you will get the following output: |
| 25 | + |
| 26 | +```terminal |
| 27 | +$ dart pub get |
| 28 | +Resolving dependencies... |
| 29 | +http 0.13.0 (affected by advisory: [^0], 1.2.0 available) |
| 30 | +Got dependencies! |
| 31 | +Dependencies are affected by security advisories: |
| 32 | + [^0]: https://github.com/advisories/GHSA-4rgh-jx4f-qfcq |
| 33 | +``` |
| 34 | + |
| 35 | +If resolution identifies an advisory, the Dart team recommends you |
| 36 | +visit the link and review the advisory. |
| 37 | +If you assess that the vulnerability affects your package, you |
| 38 | +should strongly consider upgrading to a non-affected version of the dependency. |
| 39 | + |
| 40 | + |
| 41 | +### Ignoring security advisories |
| 42 | + |
| 43 | +If a security advisory is not relevant for your application, |
| 44 | +you can suppress the warning by adding the advisory identifier to |
| 45 | +the `ignored_advisories` list in the `pubspec.yaml` of your package. |
| 46 | +For example, the following ignores the advisory |
| 47 | +with the CVE identifier `GHSA-4rgh-jx4f-qfcq`: |
| 48 | + |
| 49 | +```yaml |
| 50 | +name: myapp |
| 51 | +dependencies: |
| 52 | + foo: ^1.0.0 |
| 53 | +ignored_advisories: |
| 54 | + - GHSA-4rgh-jx4f-qfcq |
| 55 | +``` |
| 56 | +
|
| 57 | +The `ignored_advisories` list only affects the root package. Ignored |
| 58 | +advisories in your dependencies will have no effect on package resolution |
| 59 | +for your own packages. |
0 commit comments