The advisory check
Last updated .
What is the advisory check?
When a new security advisory names an npm or PyPI package one of your repositories uses, MergeSafe reads that repository’s code to see whether you are actually affected. If you are, it tells you by email, by a GitHub issue, or both, and closes the issue once you are no longer affected.
What starts a check
MergeSafe keeps a list of the packages and versions each repository declares, read from its default branch at least once a day. A check starts when a new advisory, or a change that widens an existing one, covers a version a repository declares, or a version range it allows. No pull request is needed.
What “affected” means
- Affected: the repository declares an exact affected version, and its code calls the affected part.
- May affect: the repository declares a version range, or the check could not tell.
- Not reachable: an affected version is present but your code doesn’t call the affected part, or the advisory is disputed. Nothing is sent.
Only “affected” and “may affect” are sent, plus an update with the check’s result after an alert sent as not verified (below). Every advisory that reached your repositories is listed in the app, under Settings, Security advisories.
Where it goes
In Settings, Security advisories, an Admin picks Email, Issue, Both or None for each severity. By default Low is None, Medium is Issue, and High and Critical are Both.
- Email goes to members who can see the repository and want security advisory emails.
- Issue opens one GitHub issue per repository and advisory, while your organization’s GitHub Issues switch is on (Integrations page). With it off, the email is sent instead.
- With Slack connected, the same alert is posted in your channel.
When your balance doesn’t cover the check
You still get the alert, through the same routing, marked not verified: your repository declares a version the advisory names, but MergeSafe has not yet checked whether your code uses the affected part. It names the package, your version and the version that fixes it. The alert itself is free. The check runs on its own once your balance and spending limit allow it, within 30 days, and its result comes as an update: a comment on the same issue, and an email or Slack message marked “Update”. The update says whatever the check finds: affected, may be affected, or not affected.
The issue’s lifecycle
- Opened when a repository is affected or may be.
- Commented on when a later change to the advisory changes what it says.
- Closed, with a comment, once no package it names is declared at an affected version. A version range doesn’t count as clear, and neither does a repository MergeSafe could not read.
- Reopened if a later check finds the repository affected again. An issue someone closed by hand stays closed.
What it costs
The CVE check is free. MergeSafe matches every new security advisory against the packages and versions your repositories declare, at no charge.
CVE verification is 5¢, and runs only when an advisory hits one of your repositories. It checks whether the advisory is real and whether your code actually uses the affected part. It comes out of your balance; the free $20 credit covers it. An organization is never charged more than 50¢ a day or $5 a month; past either cap, verifications keep running free. A failed verification is free. See How reviews are charged.
It is on by default. An Admin can turn it off under Settings, Security advisories. While it is off, advisories are listed without a check and nothing is sent. When your balance or a spending limit doesn’t cover a check, you still get a free alert marked not verified; the 5¢ check runs once your balance allows. Either way, those from the last 30 days are checked once it can run.
Major advisories that don’t affect you
When a critical advisory is known to be exploited and none of your repositories use the package, MergeSafe can email your members to say so, listing any repository it could not check. It is free and on by default; turn it off in the same settings.
Next: @mergesafe commands →