– [Configure and Use Dependency Management] Which security feature shows a vulnerable dependency in a pull request?

Dependency review is a security feature specifically designed to operate within the pull request workflow. It automatically scans for changes in dependency manifest files and lock files. When a pull request introduces a new or updated dependency, dependency review checks it against the GitHub Advisory Database. If a vulnerability is found, it is flagged directly in the "Files changed" tab of the pull request, allowing reviewers to identify and address potential security risks before the code is merged into the main branch.

A. Dependency graph provides a repository-level summary of all dependencies; it does not function as a review tool within a specific pull request's changes.

C. Dependabot alerts notify you of existing vulnerabilities in your repository's default branch, rather than proactively showing vulnerabilities introduced in a pending pull request.

D. The repository's Security tab is a centralized dashboard for viewing security alerts and configurations, not the specific feature that reviews dependency changes in a pull request.

1. GitHub Docs

"About dependency review." This document states

"Dependency review helps you understand dependency changes and the security impact of these changes at every pull request. It provides an easily understandable visualization of dependency changes with a rich diff on the 'Files Changed' tab of a pull request." (Source: https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-dependency-review

Section: "What is dependency review?")

2. GitHub Docs

"Reviewing dependency changes in a pull request." This guide details the process: "The dependency review for a pull request shows... which dependencies have known vulnerabilities... You can find the dependency review on the Files changed tab of a pull request." (Source: https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/reviewing-dependency-changes-in-a-pull-request

Section: "About the dependency review")