– [Configure and Use Dependency Management] In the pull request, how can developers avoid adding new dependencies with known vulnerabilities?

The dependency review action is a GitHub Action specifically designed to prevent the introduction of vulnerable dependencies. When configured in a workflow, it runs on pull requests, scans for any changes to dependencies (additions or updates), and cross-references them with the GitHub Advisory Database. If a new dependency has a known vulnerability, the action can be configured to fail the workflow, blocking the pull request from being merged. This provides immediate feedback to developers within their workflow, effectively preventing vulnerable components from entering the codebase.

A. Enable Dependabot alerts.

This feature notifies you about vulnerabilities in dependencies already present in your repository's default branch, rather than preventing new ones from being added in a pull request.

B. Add Dependabot rules.

This refers to configuring the dependabot.yml file, which controls Dependabot version and security updates, not for scanning developer-initiated pull requests for new vulnerable dependencies.

D. Enable Dependabot security updates.

This feature automatically creates pull requests to fix existing vulnerabilities in your repository. It is a reactive measure, not a preventative check on incoming pull requests.

---

1. GitHub Docs

"About dependency review": "Dependency review helps you understand dependency changes and the security impact of these changes at every pull request... You can use the dependency-review-action to introduce dependency review into your repository's pull requests."

Source: GitHub

Inc. (2023). About dependency review. GitHub Docs. Retrieved from https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-dependency-review

2. GitHub Docs

"Configuring dependency review": This document provides the specific YAML configuration for the workflow. "To use the dependency review action

you need to set up a GitHub Actions workflow that is triggered by the pullrequest event."

Source: GitHub

Inc. (2023). Configuring dependency review. GitHub Docs. Retrieved from https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/configuring-dependency-review

3. GitHub Docs

"About Dependabot alerts": "Dependabot alerts tell you that your code depends on a package with a security vulnerability... GitHub detects vulnerable dependencies in public repositories and generates Dependabot alerts." (This clarifies its role is alerting on existing dependencies

not blocking PRs).

Source: GitHub

Inc. (2023). About Dependabot alerts. GitHub Docs. Retrieved from https://docs.github.com/en/code-security/dependabot/dependabot-alerts/about-dependabot-alerts

4. GitHub Docs

"Configuring Dependabot security updates": "Dependabot security updates make it easier for you to fix vulnerable dependencies in your repository. If you enable this feature

when a Dependabot alert is raised for a vulnerability in a dependency in the dependency graph of your repository

Dependabot automatically tries to fix it." (This confirms it is a remediation tool

not a preventative PR check).

Source: GitHub

Inc. (2023). Configuring Dependabot security updates. GitHub Docs. Retrieved from https://docs.github.com/en/code-security/dependabot/dependabot-security-updates/configuring-dependabot-security-updates