You have enabled security updates for a repository. When does GitHub mark a Dependabot alert as resolved for that repository?

Question

Options

• Awhen you merge a pull request that contains a security update
• Bwhen Dependabot creates a pull request to update dependencies
• Cwhen you dismiss the Dependabot alert
• Dwhen the pull request checks are successful

• A
  86% (30)
• B
  3% (1)
• C
  9% (3)
• D
  3% (1)

Explanation

A Dependabot alert is marked as resolved (auto-dismissed) only when you actually merge the pull request that contains the security update - meaning the vulnerable dependency has been replaced with a safe version in the codebase. Simply creating a PR (B) does not resolve the alert; the vulnerability still exists until the fix is merged. Dismissing the alert (C) closes it but does not fix the underlying vulnerability. Passing PR checks (D) only validates code quality, not that the merge has occurred.

No community discussion yet for this question.