What will happen if Dependabot discovers a vulnerable transitive dependency in a repository?

Question

Options

• AIt creates a pull request to update the direct dependency to a version that resolves the
• BIt opens a pull request to update the affected package directly, regardless of version compatibility.
• CIt automatically removes the package from the repository.
• DIt sends an email to the repository owner but does not alter code.

• A
  88% (45)
• B
  6% (3)
• C
  4% (2)
• D
  2% (1)

Explanation

Option A is correct because Dependabot understands the dependency graph - when a vulnerable transitive (indirect) dependency is found, the fix must come through updating the direct dependency that pulls it in, targeting a version whose own dependency tree resolves the vulnerability. This is the only safe, compatibility-aware approach.

Why the distractors fail:

• B is wrong because Dependabot does not directly update transitive dependencies in isolation - doing so would bypass package resolution and break the dependency graph.
• C is wrong because Dependabot never removes packages; it only proposes version upgrades via PRs.
• D is wrong because Dependabot acts on code (PRs), not just notifications - email-only is the behavior of a simpler alerting tool, not Dependabot.

Memory tip: Think of transitive dependencies as "grandchildren" - you can't discipline a grandchild directly, so you talk to the parent (direct dependency) and ask them to bring a better-behaved grandchild. Dependabot always goes through the parent.

No community discussion yet for this question.