Question

Your organization's dependency scanning has raised several Dependabot alerts across multiple repositories, all linked to a single GitHub Security Advisory (GHSA). Three days later, a security engineer notices that the upstream advisory has been marked as 'Withdrawn' in the GitHub Advisory Database, with a note that the vulnerability report was determined to be invalid. Some teams have already started upgrading the dependency. What is the most appropriate remediation-workflow response?

Accepted Answer

Because the advisory was withdrawn, the associated Dependabot alerts will no longer be actionable; verify that GitHub auto-closes the alerts and communicate to teams that pending upgrades for this GHSA can be deprioritized.

Answer

Immediately dismiss every alert with the reason 'This alert is inaccurate or incorrect' and permanently disable Dependabot alerts for those repositories to prevent recurrence.

Answer

Continue forcing all teams to complete the dependency upgrade, since a withdrawn advisory still indicates a confirmed exploitable vulnerability that must be patched.

Answer

Open a new GitHub Security Advisory in each affected repository to override the withdrawn upstream advisory and re-trigger the alerts for tracking.