Question

A platform team maintains an internal npm package consumed by twelve product repositories across your organization. A newly published GHSA reveals a high-severity prototype-pollution flaw in a third-party dependency that the platform package pulls in transitively. Leadership wants a single, coordinated remediation effort that gives each product team visibility into their own affected repositories, tracks progress against a shared deadline, and avoids twelve independent, uncoordinated fixes. Which approach best meets these requirements using GitHub Advanced Security capabilities?

Accepted Answer

Create a security campaign at the organization level that groups the related Dependabot alerts across the affected repositories, assigns each repository's alerts to its owning team, and sets a shared remediation deadline.

Answer

Open a draft security advisory in each of the twelve product repositories and use the private fork to coordinate a fix independently in each one.

Answer

Configure a cross-suite ruleset that blocks all pull requests in the twelve repositories until the vulnerable dependency version is no longer present.

Answer

Enable Dependabot security updates on the platform package only and rely on transitive resolution to silently patch all twelve consumers without notifying the product teams.