GH-500 · Question #46
Which of the following dependencies could trigger a Dependabot alert? Each answer presents a complete solution. (Choose two.)
The correct answer is B. direct dependencies explicitly declared in a manifest D. indirect dependencies explicitly declared in a lockfile. Dependabot alerts are triggered by two categories of dependencies: direct dependencies explicitly declared in a manifest file (B), such as a package.json or requirements.txt entry, and indirect (transitive) dependencies explicitly declared in a lockfile (D), such as…
Question
Which of the following dependencies could trigger a Dependabot alert? Each answer presents a complete solution. (Choose two.)
Options
- Aloose dependencies declared in a manifest
- Bdirect dependencies explicitly declared in a manifest
- Cdirect dependencies at 08:00 UTC
- Dindirect dependencies explicitly declared in a lockfile
How the community answered
(26 responses)- A8% (2)
- B88% (23)
- C4% (1)
Explanation
Dependabot alerts are triggered by two categories of dependencies: direct dependencies explicitly declared in a manifest file (B), such as a package.json or requirements.txt entry, and indirect (transitive) dependencies explicitly declared in a lockfile (D), such as package-lock.json or Pipfile.lock. These represent dependencies that GitHub can definitively identify and match against its vulnerability database. 'Loose' dependencies (A) - version ranges or unpinned dependencies - cannot be reliably matched to a specific vulnerable version and do not trigger alerts. Time of day (C) is irrelevant; Dependabot checks run on a schedule independent of the time declared.
Topics
Community Discussion
No community discussion yet for this question.