GH-500 · Question #38
Which security feature shows a vulnerable dependency in a pull request?
The correct answer is A. dependency review. Dependency review is the feature designed specifically to surface vulnerable dependencies within the context of a pull request, before any changes are merged. It compares the dependencies in the base branch versus the head branch and highlights any added packages that have…
Question
Which security feature shows a vulnerable dependency in a pull request?
Options
- Adependency review
- Bdependency graph
- CDependabot alert
- Dthe repository's Security tab
How the community answered
(46 responses)- A93% (43)
- C2% (1)
- D4% (2)
Explanation
Dependency review is the feature designed specifically to surface vulnerable dependencies within the context of a pull request, before any changes are merged. It compares the dependencies in the base branch versus the head branch and highlights any added packages that have known vulnerabilities. The dependency graph (B) maps all project dependencies but does not flag vulnerabilities inline in PRs. Dependabot alerts (C) notify about vulnerabilities in already-merged dependencies, not specifically during PR review. The Security tab (D) provides a broad overview of security findings across the whole repository, not scoped to a specific PR.
Topics
Community Discussion
No community discussion yet for this question.