Question

A security engineer at a fintech company is building a remediation runbook. She needs to document the correct end-to-end handling for two different alert types. For a Dependabot alert flagging a vulnerable transitive dependency (with a fix version available), the runbook must specify the primary remediation action that GitHub can automate. For a CodeQL alert flagging a SQL injection in first-party code, the runbook must specify who owns the fix. Which pairing correctly reflects how each remediation workflow operates?

Accepted Answer

The Dependabot alert is remediated by an auto-generated security update pull request bumping the dependency to the fixed version; the CodeQL alert requires a developer to change the application source code, as no dependency bump can resolve it.

Answer

Both alerts can be resolved automatically by Dependabot security update pull requests, since Dependabot patches both dependency and source-code vulnerabilities.

Answer

The Dependabot alert must be fixed by manually editing source code, while the CodeQL alert is remediated by an auto-generated pull request that upgrades the affected package.

Answer

Both alerts must be dismissed with a documented reason because GitHub does not provide any automated remediation for either alert type.