Question

A platform team enables Dependabot alerts across all repositories. In one Node.js repository, they notice that a Dependabot alert for a vulnerability affecting a package listed only under devDependencies was automatically dismissed by GitHub, even though the maintainers never manually reviewed it. The team wants to understand why this happened so they can decide whether to change the behavior. Which explanation correctly describes this auto-dismiss behavior?

Accepted Answer

Dependabot auto-dismisses alerts for vulnerabilities that only affect development dependencies when the advisory indicates the vulnerable code is not reachable in production, and this behavior can be turned off in the repository's security settings.

Answer

Dependabot automatically dismisses any alert older than 30 days if no pull request has been merged, regardless of dependency scope.

Answer

Dependabot auto-dismisses alerts whenever the EPSS score falls below 0.1, since low-probability exploits are considered non-actionable.

Answer

Dependabot permanently deletes alerts for devDependencies because development-only packages are excluded from the dependency graph entirely.