Which of the following options would close a Dependabot alert?

The correct answer is C. creating a pull request to resolve the vulnerability that will be approved and merged. A Dependabot alert is automatically closed when the vulnerable dependency is updated to a non-vulnerable version via a merged pull request. Simply viewing the alert, viewing the dependency graph, or leaving the repository unchanged does not resolve or close the alert…

Configure and use Dependabot and Dependency Review

Question

Options

Aviewing the dependency graph
Bleaving the repository in its current state
Ccreating a pull request to resolve the vulnerability that will be approved and merged
Dviewing the Dependabot alert on the Dependabot alerts tab of your repository

How the community answered

(21 responses)

A
5% (1)
B
10% (2)
C
81% (17)
D
5% (1)

Explanation

A Dependabot alert is automatically closed when the vulnerable dependency is updated to a non-vulnerable version via a merged pull request. Simply viewing the alert, viewing the dependency graph, or leaving the repository unchanged does not resolve or close the alert. Dismissing an alert manually is also an option, but that is different from actually resolving the vulnerability.

Topics

#Dependabot alerts#Vulnerability resolution#Dependency management#Security remediation

Community Discussion

No community discussion yet for this question.

Full GH-500 Practice