Security updates

Deplo reads the packages of every image it runs and matches them against OSV.dev every 6 hours. One security update is one package to move; updates lists every advisory behind it, so group them by packageName and installedVersion to count the way the dashboard does. fix says how the team gets the fix, and actionable whether it counts at all. Every call on one app or database names exactly one appId or databaseId.

ReadingCopy Anchor Link

securityUpdatesCopy Anchor Link

Any signed-in principal. Returns SecurityUpdates.

The security updates of one app (appId) or managed database (databaseId) in the active team. Null when it is out of reach or the instance turned checks off.

query {
  securityUpdates(appId: "prj_9f1c2ab7d3e4f5a6") {
    checkedAt
    count
    exploited
    newerTag
  }
}

securityUpdatesOverviewCopy Anchor Link

Any signed-in principal. Returns [SecuritySubject!].

Every app and database in the active team with security updates to apply, most urgent first. Empty when the instance turned checks off.

query {
  securityUpdatesOverview {
    id
    name
    count
    exploited
  }
}

IgnoringCopy Anchor Link

ignoreSecurityUpdateCopy Anchor Link

Needs ignore_security_updates. Returns Boolean.

Set advisories aside on one app or database for 30, 90 (default) or 180 days, with an optional reason. They stay listed but stop counting and alerting until then; a new advisory still shows. Recorded in Activity.

mutation {
  ignoreSecurityUpdate(vulnIds: ["GHSA-xvch-5gv4-984h"])
}

unignoreSecurityUpdateCopy Anchor Link

Needs ignore_security_updates. Returns Boolean.

Count and alert on advisories set aside with ignoreSecurityUpdate again. Recorded in Activity.

mutation {
  unignoreSecurityUpdate(vulnIds: ["GHSA-xvch-5gv4-984h"])
}

The instance switchCopy Anchor Link

securityUpdatesStatusCopy Anchor Link

Instance admin only. Returns SecurityUpdatesStatus.

query {
  securityUpdatesStatus {
    enabled
    failingSince
    lastCheckedAt
  }
}

setSecurityUpdatesEnabledCopy Anchor Link

Instance admin only. Returns SecurityUpdatesStatus.

Turn security update checks on or off for the whole instance. On, Deplo sends OSV.dev the name and version of each package the team's images contain, never an app name or anything that identifies this Deplo. Recorded in Activity.

mutation {
  setSecurityUpdatesEnabled(enabled: true) {
    enabled
    failingSince
    lastCheckedAt
  }
}

See alsoCopy Anchor Link