– [Configure and Use Dependency Management] You are a maintainer of a repository and Dependabot notifies you of a vulnerability. Where could the…

Dependabot identifies vulnerabilities by cross-referencing a repository's dependencies against known security issues. Its primary sources for this information are the GitHub Advisory Database, which includes advisories reported directly on GitHub, and the National Vulnerability Database (NVD), a public repository of vulnerability data. When a vulnerability is disclosed in either of these sources and matches a dependency in the repository, Dependabot generates an alert. These databases are the authoritative sources where vulnerability information is officially published and cataloged.

B. The dependency graph visualizes a repository's dependencies; it is scanned by Dependabot but is not the source where vulnerabilities are originally disclosed.

D. Manifest and lock files declare a project's dependencies; they are the input for building the dependency graph, not a database of vulnerability disclosures.

1. GitHub Docs

"About Dependabot alerts": "GitHub detects vulnerable dependencies and sends Dependabot alerts when... New vulnerability data is synchronized from the National Vulnerability Database... [or] A new vulnerability is added to the GitHub Advisory Database." This confirms that both the NVD (A) and GitHub's own advisories (C) are the sources.

2. GitHub Docs

"About the GitHub Advisory Database": "The GitHub Advisory Database contains a curated list of security vulnerabilities... We add advisories to the GitHub Advisory Database from the following sources: The National Vulnerability Database... [and] Security advisories reported on GitHub." This explicitly lists both correct options as sources for the database that Dependabot uses.

3. GitHub Docs

"About the dependency graph": "The dependency graph is a summary of the manifest and lock files stored in a repository... For repositories with the dependency graph enabled

GitHub automatically scans manifests and lock files..." This clarifies that the dependency graph (B) and manifest/lock files (D) are inputs for the scanning process

not sources of vulnerability disclosure.