– [Configure and Use Dependency Management] Which of the following options would close a Dependabot alert?

A Dependabot alert is automatically closed when the vulnerability that triggered it is resolved. The standard resolution process involves updating the insecure dependency to a secure version. This is typically accomplished by creating a pull request with the necessary changes to the manifest or lock file. Once this pull request is reviewed, approved, and merged into the default branch, GitHub automatically rescans the repository's dependencies. Upon confirming that the vulnerable dependency has been updated, GitHub closes the alert.

B. Viewing an alert is a passive, informational action. It does not change the repository's code or dependencies, and therefore does not resolve the vulnerability.

C. The dependency graph is a tool for visualizing dependencies. Simply viewing it does not alter the repository's state or fix any security issues.

D. Leaving the repository in its current state means the vulnerability persists. The Dependabot alert will remain open until the issue is addressed or manually dismissed.

1. GitHub Docs

"Viewing and updating Dependabot alerts." Under the section "Fixing a Dependabot alert

" the documentation states: "When you merge a pull request that updates the manifest or lock file to a secure version of the dependency

the alert is resolved for your repository. Dependabot automatically closes the alert when it detects that the vulnerable dependency has been removed or updated." This directly supports that merging a pull request to fix the vulnerability closes the alert.