What should you do after receiving an alert about a dependency added in a pull request?

The correct answer is D. Update the vulnerable dependencies before the branch is merged. When dependency review or Dependabot alerts flag a vulnerable dependency in a pull request, the correct response is to update the vulnerable dependency to a safe version before merging the branch. Merging known-vulnerable code into the default branch (C) or forking and…

Configure and use Dependabot and Dependency Review

Question

Options

ADisable Dependabot alerts for all repositories owned by your organization.
BFork the branch and deploy the new fork.
CDeploy the code to your default branch.
DUpdate the vulnerable dependencies before the branch is merged.

How the community answered

(53 responses)

A
6% (3)
B
2% (1)
C
9% (5)
D
83% (44)

Explanation

When dependency review or Dependabot alerts flag a vulnerable dependency in a pull request, the correct response is to update the vulnerable dependency to a safe version before merging the branch. Merging known-vulnerable code into the default branch (C) or forking and deploying it (B) would introduce the vulnerability into production. Disabling Dependabot alerts entirely (A) eliminates a critical security signal and is never an appropriate response to a specific alert. The goal of catching vulnerabilities at PR time is precisely to fix them before they reach the main branch.

Topics

#Dependabot#Dependency Review#Vulnerability Remediation#Pull Request Security

Community Discussion

No community discussion yet for this question.

Full GH-500 Practice