Assuming there is no custom Dependabot behavior configured, where possible, what does Dependabot do after sending an alert about a vulnerable dependency in a repository?

Question

Options

• Ascans repositories for vulnerable dependencies on a schedule and adds those files to a manifest
• Bscans any push to all branches and generates an alert for each vulnerable repository
• Ccreates a pull request to upgrade the vulnerable dependency to the minimum possible secure
• Dconstructs a graph of all the repository's dependencies and public dependents for the default

• A
  2% (1)
• B
  2% (1)
• C
  88% (44)
• D
  8% (4)

Explanation

In repositories where Dependabot security updates are enabled, when GitHub detects a vulnerable dependency in the default branch, Dependabot creates a pull request to fix it. The pull request will upgrade the dependency to the minimum possible secure version needed to avoid the vulnerability.

No community discussion yet for this question.