Learn exactly when GitHub’s Dependabot dependency security scanning tool creates alerts for vulnerable dependencies in your repositories.
Table of Contents
Question
When is a Dependabot alert generated?
A. When a new advisory is added to the GitHub Advisory Database or the dependency graph for a repository changes.
B. Whenever a pull request attempts to merge changes into the main branch that contain no dependency changes.
C. Whenever a new vulnerability is removed from the GitHub Advisory Database.
Answer
A. When a new advisory is added to the GitHub Advisory Database or the dependency graph for a repository changes.
Explanation
Dependabot alerts are generated under two conditions: a new vulnerability is added to the GitHub Advisory Database or the dependency graph for a repository changes.
Dependabot alerts are generated in two scenarios:
- When a new security advisory is added to the GitHub Advisory Database that identifies a vulnerability in one of the dependencies used in a repository. GitHub maintains this database of known vulnerabilities.
- When the dependency graph for a repository changes, such as when a contributor adds, removes, or updates a dependency via a commit. Dependabot scans the updated dependency tree against the advisory database.
In both cases, if any dependencies in the repository match a vulnerability advisory, Dependabot will create a security alert to notify maintainers. It determines this based on factors like the affected versions specified in the advisory.
Dependabot continuously monitors both the GitHub Advisory Database and the dependency graphs of repositories for any changes. This allows it to surface new alerts whenever a repository becomes vulnerable, either due to a newly disclosed vulnerability or a change to its dependencies.
To summarize, the correct answer is: A) When a new advisory is added to the GitHub Advisory Database or the dependency graph for a repository changes. Dependabot does not generate alerts for pull requests with no dependency changes or when vulnerabilities are removed from the advisory database.
GitHub Advanced Security certification exam assessment practice question and answer (Q&A) dump including multiple choice questions (MCQ) and objective type questions, with detail explanation and reference available free, helpful to pass the GitHub Advanced Security exam and earn GitHub Advanced Security certification.