Configure and use supply chain security

A platform team enables Dependabot alerts across all repositories. In one Node.js repository, they notice that a Dependabot alert for a vulnerability affecting a package listed only under devDependencies was automatically dismissed by GitHub, even though the maintainers never manually reviewed it. The team wants to understand why this happened so they can decide whether to change the behavior. Which explanation correctly describes this auto-dismiss behavior?

A security engineer at a fintech company is overwhelmed by Dependabot alerts, many of which relate to vulnerabilities that currently have no available patch. She wants Dependabot to automatically snooze these unpatchable alerts and then automatically resurface them the moment a fixed version becomes available, without permanently dismissing them. Which Dependabot capability should she configure to achieve this behavior?

A platform team maintains a large Node.js monorepo where Dependabot opens dozens of separate pull requests each week for minor and patch updates across many npm packages. Reviewers are overwhelmed by the volume of individual PRs, and the team wants to consolidate related updates into fewer, batched pull requests while still keeping major version bumps separate for careful review. Which Dependabot configuration change best achieves this goal?

Your organization wants to route Dependabot alerts to a dedicated security team using a shared inbox, while ensuring that the platform engineering team (who own the repositories) can still triage and dismiss alerts. A security analyst who is NOT a repository collaborator needs to receive email notifications for new Dependabot alerts on several repositories. What must be true for this analyst to receive those alert notifications?

A platform team maintains a Node.js service with a dependabot.yml configuration. They want Dependabot to raise version-update pull requests that always bump dependencies to the latest available version, ignoring the version range constraints currently declared in package.json. Which configuration option should they set to achieve this behavior?

A platform team wants Dependabot to keep their npm dependencies current by opening pull requests on a weekly schedule for all outdated packages, not only for those with known vulnerabilities. They already receive Dependabot alerts and automatic security update PRs. Which additional configuration must they add to achieve the weekly update behavior?

Your security team runs a centralized incident-response platform that must receive real-time data whenever a new Dependabot alert is created on any repository in your organization, so it can automatically open tickets. You want a native GitHub mechanism that pushes alert events to your external system as they happen, rather than requiring the platform to poll GitHub. Which approach best meets this requirement?

Your security team wants to feed Dependabot alerts into an internal ticketing system so that a ticket is automatically created whenever a new dependency vulnerability is detected. The integration engineer needs to know which mechanism GitHub provides to push these events to an external endpoint in real time, and what payload identifier distinguishes a newly surfaced alert from other alert lifecycle events. Which approach correctly satisfies this requirement?

A platform engineering team maintains a monorepo with several JavaScript services. They notice the dependency graph in the repository's Insights tab only shows a partial list of packages, missing many transitive dependencies. Investigating, they find that most services commit only their package.json files, while a few also commit package-lock.json. What is the most likely reason the dependency graph is incomplete, and how should the team resolve it?

A platform engineering team wants to answer a compliance auditor's request: they must produce a machine-readable inventory of all direct and transitive open-source components used by a repository, in a widely accepted standard format that can be ingested by the auditor's third-party tooling. The team wants to accomplish this with a built-in GitHub capability rather than a custom script. Which action satisfies this requirement?

A platform team builds Java services with Gradle, where many runtime dependencies are only resolved during the build and are not listed explicitly in the checked-in build files. The security lead notices that GitHub's dependency graph for these repositories misses these transitively resolved dependencies, so Dependabot alerts are incomplete. Which approach lets GitHub include the full, build-resolved dependency set in the dependency graph?

A platform team enforces the Dependency Review Action on all repositories with a policy to fail any pull request introducing a dependency with a 'high' or 'critical' vulnerability. A development team is blocked by a specific critical advisory (GHSA-xxxx-yyyy-zzzz) in a transitive dependency that has no available patch, but their security team has assessed the vulnerable code path as unreachable and approved a temporary exception. The team wants their PRs to pass the check for only this one advisory while keeping the strict severity gate active for all other vulnerabilities. Which Dependency Review Action configuration option should they use?

A platform team wants the Dependency Review action to block pull requests only when a newly introduced dependency has a vulnerability rated 'high' or 'critical', while still surfacing lower-severity findings as informational comments without failing the check. Which configuration approach achieves this?

Your team has enabled the Dependency Review Action on pull requests. Security wants the check to block any PR that introduces a dependency with a GPL-3.0 license, but they want vulnerability-based failures to only trigger on 'high' severity or above. A developer opens a PR that adds a new package licensed under MIT that has a 'moderate' severity vulnerability. What is the expected result of the Dependency Review Action run, assuming it is configured with 'deny-licenses: GPL-3.0' and 'fail-on-severity: high'?

Your team has added the Dependency Review Action to a repository's pull request workflow to catch vulnerable dependencies before merge. Reviewers complain that they have to open the Actions run logs to see which dependencies were flagged, and they want a concise summary posted directly on the pull request itself. Which configuration change accomplishes this without adding a separate third-party bot?

A platform team wants to add the Dependency Review action to pull request workflows for a private repository so that vulnerable or non-compliant dependency changes are flagged before merge. When they run the workflow, the action fails with an error indicating it cannot access dependency data. Which prerequisite must be satisfied for the Dependency Review action to function in this repository?

A platform engineer adds the Dependency Review Action to a repository's pull request workflow, but every run fails with an error indicating the action cannot access the dependency comparison data for the pull request. The repository has GitHub Advanced Security enabled and the dependency graph is active. What is the MOST likely configuration issue causing this failure?

A platform team maintains a Node.js monorepo where devDependencies (test runners, linters, build tooling) are numerous and frequently trigger Dependency Review failures on pull requests, blocking merges for vulnerabilities that never ship to production. The security lead wants Dependency Review to still fail the PR check for vulnerable production dependencies but stop failing on issues that only affect development-time packages. Which configuration approach for the Dependency Review action best achieves this?

A financial services company mandates that no dependency using a GPL-3.0 license may be merged into their default branch. A platform engineer is configuring the Dependency Review Action in a GitHub Actions workflow to enforce this. Which configuration approach will cause the pull request check to FAIL when a newly introduced dependency uses GPL-3.0?

Your security team is triaging a backlog of Dependabot alerts across several production repositories. Two alerts have the same CVSS base score of 7.5 (High). Alert A affects a vulnerability with an EPSS score of 0.92, while Alert B has an EPSS score of 0.03. With limited engineering capacity this sprint, which alert should be prioritized for remediation first, and why?