Commit 7fa55a0

To protect maintainers from spam and abuse, {% data variables.product.github %} limits the number of private vulnerability reports that you can submit:

* You can submit a maximum of 25 reports per 24-hour period across repositories where you are not a trusted reporter.

* You can submit a maximum of 5 reports to a single repository per 24-hour period.

* By default, a repository accepts a maximum of 10 reports per 24-hour period from all reporters combined.

Repository maintainers can set a lower or higher total limit for their repository and exempt trusted reporters. Reports to a repository where you are a trusted reporter are exempt from that repository's limits and do not count toward your global 25-report limit. Reports to other repositories still count toward both the global limit and each repository's limits.

If you reach a rate limit, you will see a message when you try to submit a new report on {% data variables.product.github %}. Each 24-hour period starts with the first report that counts toward that limit, and the limit resets in full when the period ends.

You'll need Node.js to run the site. Check the version in `package.json`. To install Node.js, [download the "LTS" installer from nodejs.org](https://nodejs.org). To use a Node version manager instead, see [Node versions](./node-versions.md#install-nodejs-locally).

You don't need a Node version manager, but it makes switching versions easier. We recommend [fnm](https://github.com/Schniz/fnm).

1. Install fnm. On macOS, run `brew install fnm`. For other systems, see the [fnm installation docs](https://github.com/Schniz/fnm#installation).

1. Set up your shell. For Zsh, add this line to `~/.zshrc`. For Bash, add it to `~/.bashrc` and change `zsh` to `bash`. For other shells, see [fnm shell setup](https://github.com/Schniz/fnm#shell-setup).

1. Open a new terminal. Install the latest major version listed in `engines.node` in `package.json`, make it your default, and switch to it. For example, for Node.js 26:

```shell

fnm install 26

fnm default 26

fnm use 26

```

1. Run `node --version` to check. If you see a different version, another version manager may be active in your shell. Check your shell profile.

versions:

fpt: '*'

ghec: '*'

ghes: '>= 3.24'

| {% ifversion dependabot-apm-support %} |

| APM | `apm` | Any SemVer prerelease identifier (commonly `alpha`, `beta`, `rc`) | `microsoft/edge-ai#v1.1.0-rc.1`, `octo-org/octo-skills/skills/review#review-v2.0.0-beta.1` |

| {% endif %} |

{% ifversion dependabot-apm-support %}

* **APM:** Resolves dependency versions from git tags. Both plain tags (`v1.4.0`) and package-scoped tags (`review-v1.4.0`, `review--v1.4.0`, `review_v1.4.0`) are recognized. The prefix of a package-scoped tag must match the package name, which is the repository name or the last component of a virtual package path. Build metadata (`+...`) is ignored for version precedence. Commit SHA pins only move to annotated, non-prerelease release tags.

{% endif %}

| {% ifversion dependabot-apm-support %} |

[APM](#apm) | `apm` | Not applicable | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} (git only) | Not applicable |

| {% endif %} |

{% ifversion dependabot-apm-support %}

{% data variables.product.prodname_dependabot %} can update git dependencies declared in `apm.yml` manifest files for APM (Agent Package Manager). Entries under both `dependencies.apm` and `devDependencies.apm` are updated. For more information about APM, see [`microsoft/apm` repository](https://github.com/microsoft/apm) in the `microsoft/apm` repository.

How {% data variables.product.prodname_dependabot %} updates a dependency depends on how the dependency is pinned.

| Pin type | Example | Behavior |

|---|---|---|

| SemVer tag | `octo-org/octo-skills#v1.0.0` | Updated to the latest SemVer tag. Both plain tags (`v1.4.0`) and package-scoped tags are supported. A package-scoped tag must start with the package name, which is the repository name or the last component of a virtual package path. For example, `octo-org/octo-skills/skills/review#review-v1.4.0`. |

| Commit SHA | `octo-org/octo-skills#<40-character SHA>` | Updated to the commit of the latest annotated, non-prerelease release tag. The tag name is added as a comment, for example `# v1.4.0`. |

| Branch | `octo-org/octo-skills#main` | Updated to the latest commit on the branch. Only `apm.lock.yaml` changes, because the manifest still names the branch. Requires an existing `apm.lock.yaml` file. |

If your repository contains an `apm.lock.yaml` file, {% data variables.product.prodname_dependabot %} regenerates it by running `apm lock`. {% data variables.product.prodname_dependabot %} doesn't create a lockfile if one doesn't exist.

{% data variables.product.prodname_dependabot %} doesn't update the following entries:

* Object-form entries (`git:`, `registry:`, `id:`, or `path:` maps) and `mcp:` entries

* Entries without a ref, such as `octo-org/octo-skills`

* Local path entries, such as `./my-package`

* Entries hosted on Azure DevOps

* Entries that use an `http://` or `git://` clone URL

* Entries written as YAML block scalars (`>` or `|`) or as quoted strings that use escape sequences

* Abbreviated commit SHAs

* Shorthand entries, such as `octo-org/octo-skills#v1.2.0`, when the manifest sets `registries.default`. Entries that use an explicit clone URL are still updated.

Private registry support uses git registries. You can configure access for private git repositories by specifying a git registry in your `dependabot.yml` file. See [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configure-access-to-private-registries#git).

{% endif %}