A repository's dependency graph includes:

The correct answer is D. dependencies parsed from a repository's manifest and lock files. The dependency graph is built by GitHub by parsing the manifest and lock files found in a repository - for example, package.json / package-lock.json (npm), requirements.txt / Pipfile.lock (Python), Gemfile / Gemfile.lock (Ruby), pom.xml (Maven), etc. It is scoped to a single…

Dependency Management

Question

A repository’s dependency graph includes:

Options

Aannotated code scanning alerts from your repository's dependencies.
Bdependencies from all your repositories.
Ca summary of the dependencies used in your organization's repositories.
Ddependencies parsed from a repository's manifest and lock files.

How the community answered

(64 responses)

B
2% (1)
C
3% (2)
D
95% (61)

Explanation

The dependency graph is built by GitHub by parsing the manifest and lock files found in a repository - for example, package.json / package-lock.json (npm), requirements.txt / Pipfile.lock (Python), Gemfile / Gemfile.lock (Ruby), pom.xml (Maven), etc. It is scoped to a single repository, not all repositories or the whole organization (ruling out B and C). It does not annotate code scanning alerts from dependencies (ruling out A); that is the role of Dependabot alerts and code scanning, which are separate features.

Topics

#Dependency graph#Dependencies#Manifest files#Lock files

Community Discussion

No community discussion yet for this question.

Full GH-500 Practice