– [Configure and Use Dependency Management] A repository's dependency graph includes:

The dependency graph for a specific repository is a feature that identifies all upstream dependencies and public downstream dependents. GitHub generates this graph by parsing manifest files (e.g., package.json, requirements.txt) and lock files (e.g., package-lock.json, Gemfile.lock) committed to the repository's default branch. This parsed information forms the basis of the graph, detailing the packages and versions the project relies on. Other security features, such as Dependabot alerts, then use this graph to identify vulnerabilities.

B. Annotated code scanning alerts are a separate feature that uses the dependency graph to flag vulnerabilities; they are not a component of the graph itself.

C. This describes the organization-level dependency insights view, which aggregates data from multiple repositories, not the graph for a single repository.

D. The dependency graph is scoped to a single repository, not an aggregation of dependencies from all of a user's or organization's repositories.

1. GitHub Docs. (n.d.). About the dependency graph. Retrieved from https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-the-dependency-graph

Section: "Dependency graph": "The dependency graph is a summary of the manifest and lock files stored in a repository... GitHub scans common package manifest files... in the default branch of your repository to find dependencies."

2. GitHub Docs. (n.d.). About Dependabot alerts. Retrieved from https://docs.github.com/en/code-security/dependabot/dependabot-alerts/about-dependabot-alerts

Section: "Detection of insecure dependencies": This page explains that Dependabot alerts are generated when a vulnerability is found for a dependency listed in the dependency graph, clarifying that alerts are a separate, subsequent process.

3. GitHub Docs. (n.d.). Viewing the dependency graph for your repository. Retrieved from https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/viewing-the-dependency-graph-for-your-repository

This document explicitly details the process for viewing the graph on a per-repository basis, reinforcing that its scope is a single repository.