In the pull request, how can developers avoid adding new dependencies with known vulnerabilities?

The correct answer is D. Add a workflow with the dependency review action. The dependency review action is a GitHub Actions workflow that blocks pull requests from introducing dependencies with known vulnerabilities. It runs during the PR process and checks any newly added or changed dependencies against the GitHub Advisory Database before the PR is…

Configure and use Dependabot and Dependency Review

Question

Options

AEnable Dependabot security updates.
BAdd Dependabot rules.
CEnable Dependabot alerts.
DAdd a workflow with the dependency review action.

How the community answered

(40 responses)

A
15% (6)
B
10% (4)
C
5% (2)
D
70% (28)

Explanation

The dependency review action is a GitHub Actions workflow that blocks pull requests from introducing dependencies with known vulnerabilities. It runs during the PR process and checks any newly added or changed dependencies against the GitHub Advisory Database before the PR is merged. Dependabot alerts (C) notify after the fact, Dependabot security updates (A) create fix PRs automatically, and Dependabot rules (B) filter alerts-none of these block vulnerable deps at PR time the way the dependency review action does.

Topics

#Dependency Review#Vulnerability Prevention#Pull Request Security#GitHub Actions

Community Discussion

No community discussion yet for this question.

Full GH-500 Practice