What does GitHub's 'Dependabot security updates' feature do when it detects a vulnerability?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Dependabot doesn't just yell at you — it helps. When it spots a vulnerable dependency, it opens a PR with the fix. You review it, run your CI, and merge when ready. It's automated remediation with human oversight.
Full explanation below image
Full Explanation
When GitHub's Dependabot detects a security vulnerability in a repository's dependencies (via Dependabot alerts), the security updates feature automatically opens a pull request to update the vulnerable dependency to a secure version. The PR: (1) Targets the default branch or the branch where the vulnerability exists. (2) Includes information about the vulnerability (CVE, severity, advisory link). (3) Triggers CI/CD workflows so maintainers can verify the update doesn't break anything. (4) Can be merged when the team is satisfied the fix is safe. Dependabot does NOT push directly to main without PR review — it respects branch protection rules. It does NOT modify package.json autonomously without a PR. Dependabot alerts are separate from security updates: alerts notify, security updates take action.