docs: clarify dependency graph/review enabled/default status by hesreallyhim · Pull Request #44586 · github/docs

hesreallyhim · 2026-06-04T07:56:36Z

Summary of issue: this document/section (https://docs.github.com/en/code-security/concepts/supply-chain-security/about-supply-chain-security#feature-availability) states:

Dependency graph: Enabled by default and cannot be disabled.
Dependency review: Enabled by default and cannot be disabled.

This appears to be stale information, given other references cited in the issue mentioned below, and in particular two GitHub changelog/announcements (https://github.blog/changelog/2025-05-15-users-can-now-disable-dependency-graph-for-public-repositories/) and (https://github.blog/changelog/2025-06-17-dependency-graph-now-defaults-to-off/), the more recent of which states:

Following last month’s change that added the ability to turn off dependency graph, the setting for newly-created public repositories will now default to off.Following last month’s change that added the ability to turn off dependency graph, the setting for newly-created public repositories will now default to off.

Why:

Closes: #44585

What's being changed (if available, include any code snippets, screenshots, or gifs):

I'm submitting a change to a single doc that appears to have missed the changes made after the announcements cited above. Rather than correcting individual lines that are now false, I am proposing that the whole section, which is broken into Public, Private, and Any, be condensed, since the distinction between public and private is now significantly reduced. (More citations can be found in the linked issue.)

There is another document which contains this same error, but it is outside of the content directory, so I didn't know if I should touch it:

data/reusables/gated-features/dependency-graph.md:

The dependency graph is available for the following repository types:

* Public repositories (on by default)
* Private repositories
* Forks

I also made a change to a formatting error affecting the "Immutable Releases" item, which had an extra *, creating this visual bug:

Check off the following:

A subject matter expert (SME) has reviewed the technical accuracy of the content in this PR. In most cases, the author can be the SME. Open source contributions may require an SME review from GitHub staff.
The changes in this PR meet the docs fundamentals that are required for all content.
All CI checks are passing and the changes look good in the review environment.

welcome · 2026-06-04T07:56:40Z

Thanks for opening this pull request! A GitHub docs team member should be by to give feedback soon. In the meantime, please check out the contributing guidelines.

github-actions · 2026-06-04T07:57:10Z

How to review these changes 👓

Thank you for your contribution. To review these changes, choose one of the following options:

A Hubber will need to deploy your changes internally to review.

Table of review links

Note: Please update the URL for your staging server or codespace.

The table shows the files in the content directory that were changed in this pull request. This helps you review your changes on a staging server. Changes to the data directory are not included in this table.

Source	Review	Production	What Changed
`code-security/concepts/supply-chain-security/about-supply-chain-security.md`	fpt ghec ghes@ 3.21 3.20 3.19 3.18 3.17 3.16	fpt ghec ghes@ 3.21 3.20 3.19 3.18 3.17 3.16

Key: fpt: Free, Pro, Team; ghec: GitHub Enterprise Cloud; ghes: GitHub Enterprise Server

🤖 This comment is automatically generated.

Copilot

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Updates the supply-chain security documentation to reflect feature availability and defaults across repository types, while cleaning up formatting and consolidating repeated content.

Changes:

Consolidates public/private repository feature availability into a single set of bullets.
Updates descriptions for dependency graph, dependency review, and Dependabot alerts prerequisites.
Fixes formatting issues (for example, “Immutable releases” bullet formatting) and relocates “Artifact attestations” into the shared list.

hesreallyhim · 2026-06-04T08:02:17Z

-* **Dependency graph:** Enabled by default and cannot be disabled.
-* **Dependency review:** Enabled by default and cannot be disabled.
-* **{% data variables.product.prodname_dependabot_alerts %}:** Not enabled by default. {% data variables.product.prodname_dotcom %} detects insecure dependencies and displays information in the dependency graph, but does not generate {% data variables.product.prodname_dependabot_alerts %} by default. Repository owners or people with admin access can enable {% data variables.product.prodname_dependabot_alerts %}.
+* **Dependency graph:** Not enabled by default. Available for public and private repositories, and can be enabled or disabled by repository administrators. For more information, see [AUTOTITLE](/code-security/supply-chain-security/understanding-your-software-supply-chain/exploring-the-dependencies-of-a-repository#enabling-and-disabling-the-dependency-graph).


This change is intentional, and is the primary purpose of the PR - the distinction between public and private repos appears to represent outdated policy.

hesreallyhim · 2026-06-04T08:03:55Z

-* **Dependency review:** Enabled by default and cannot be disabled.
-* **{% data variables.product.prodname_dependabot_alerts %}:** Not enabled by default. {% data variables.product.prodname_dotcom %} detects insecure dependencies and displays information in the dependency graph, but does not generate {% data variables.product.prodname_dependabot_alerts %} by default. Repository owners or people with admin access can enable {% data variables.product.prodname_dependabot_alerts %}.
+* **Dependency graph:** Not enabled by default. Available for public and private repositories, and can be enabled or disabled by repository administrators. For more information, see [AUTOTITLE](/code-security/supply-chain-security/understanding-your-software-supply-chain/exploring-the-dependencies-of-a-repository#enabling-and-disabling-the-dependency-graph).
+* **Dependency review:** Available when the dependency graph is enabled. For private repositories, the repository must also be owned by an organization that uses {% data variables.product.prodname_team %} or {% data variables.product.prodname_ghe_cloud %} and has a license for {% data variables.product.prodname_GHAS_or_code_security %}. For more information, see [AUTOTITLE](/get-started/learning-about-github/about-github-advanced-security) and [AUTOTITLE](/code-security/supply-chain-security/understanding-your-software-supply-chain/exploring-the-dependencies-of-a-repository#enabling-and-disabling-the-dependency-graph).


The links used were preserved from the pre-existing documentation

hesreallyhim · 2026-06-04T08:04:47Z

 * **{% data variables.product.prodname_dependabot_version_updates %}:** Not enabled by default. People with write permissions to a repository can enable {% data variables.product.prodname_dependabot_version_updates %}. For information about enabling version updates, see [AUTOTITLE](/code-security/dependabot/dependabot-version-updates/configuring-dependabot-version-updates).
-* **Immutable releases*:** Not enabled by default. You can enable release immutability for a repository or organization. See [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/establish-provenance-and-integrity/preventing-changes-to-your-releases).
+* **Immutable releases:** Not enabled by default. You can enable release immutability for a repository or organization. See [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/establish-provenance-and-integrity/preventing-changes-to-your-releases).
+* **Artifact attestations:** Available in all public repositories, but you must explicitly generate attestations in your build workflows. Only available in private repositories on {% data variables.product.prodname_ghe_cloud %}. See [AUTOTITLE](/actions/how-tos/secure-your-work/use-artifact-attestations/use-artifact-attestations).


I'm happy to accept this suggestion if sub-bullets are preferred.

hesreallyhim added 2 commits June 4, 2026 03:34

docs: clarify supply chain feature availability

4e4de06

docs: fix immutable releases formatting

4945d15

Copilot AI review requested due to automatic review settings June 4, 2026 07:56

github-actions Bot added the triage Do not begin working on this issue until triaged by the team label Jun 4, 2026

Copilot AI reviewed Jun 4, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

docs: clarify dependency graph/review enabled/default status#44586

docs: clarify dependency graph/review enabled/default status#44586
hesreallyhim wants to merge 2 commits into
github:mainfrom
hesreallyhim:docs/clarify-dependency-graph-enabled

hesreallyhim commented Jun 4, 2026

Uh oh!

welcome Bot commented Jun 4, 2026

Uh oh!

github-actions Bot commented Jun 4, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

hesreallyhim Jun 4, 2026

Uh oh!

hesreallyhim Jun 4, 2026

Uh oh!

hesreallyhim Jun 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

hesreallyhim commented Jun 4, 2026

Why:

What's being changed (if available, include any code snippets, screenshots, or gifs):

Check off the following:

Uh oh!

welcome Bot commented Jun 4, 2026

Uh oh!

github-actions Bot commented Jun 4, 2026

How to review these changes 👓

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

hesreallyhim Jun 4, 2026

Choose a reason for hiding this comment

Uh oh!

hesreallyhim Jun 4, 2026

Choose a reason for hiding this comment

Uh oh!

hesreallyhim Jun 4, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants