Assuming that notification and alert recipients are not customized, what does GitHub do when it identifies a vulnerable dependency in a repository where Dependabot alerts are enabled? (Each answer…

Question

Options

• AIt generates a Dependabot alert and displays it on the Security tab for the repository.
• BIt consults with a security service and conducts a thorough vulnerability review.
• CIt generates Dependabot alerts by default for all private repositories.
• DIt notifies the repository administrators about the new alert.

• A
  89% (32)
• B
  3% (1)
• C
  8% (3)

Explanation

When GitHub identifies a vulnerable dependency in a repository with Dependabot alerts enabled, it performs the following actions: [A] Geneates a Dependabot alert: The alert is displayed on the repository's Security tab, providing details about the vulnerability and affected dependency. [D] Notifies repository maintainers: By default, GitHub notifies users with write, maintain, or admin permissions about new Dependabot alerts. These actions ensure that responsible parties are informed promptly to address the vulnerability.

No community discussion yet for this question.