Question

A security engineer enables Dependabot alerts on a repository, but no alerts appear even though the team knows a direct dependency in their Python project has a published CVE. The repository contains a requirements.txt file, and the dependency graph feature shows as enabled in the repository's Settings. What is the most likely reason Dependabot is not generating an alert?

Accepted Answer

The vulnerable version is not yet included in the GitHub Advisory Database, so Dependabot has no advisory to match against the manifest.

Answer

Dependabot alerts only work for repositories that also have Dependabot version updates configured in a dependabot.yml file.

Answer

Dependabot alerts cannot parse requirements.txt files and require a Pipfile.lock or poetry.lock instead.

Answer

Secret scanning must be enabled before Dependabot alerts can run against the dependency graph.