Free Access Microsoft GH-500 New Release

After generating an alert for a vulnerable dependency, Dependabot automatically attempts to create a pull request to upgrade that dependency to the minimum required secure version —if a fix is available and compatible with your project.

This automated PR helps teams fix vulnerabilities quickly with minimal manual intervention. You can also configure update behaviors using dependabot.yml, but in the default state, PR creation is automatic.

A repository administrator can enable secret scanning for an eligible repository that is owned by the organization, assuming the organization's GitHub plan, Secret Protection licensing, and enterprise policies permit the feature. GitHub documentation states that secret scanning alerts can be enabled for organization-owned repositories, including eligible private and internal repositories. Repository administrators manage security settings for repositories over which they have the required administrative permission. They do not obtain administrative control over separate user-owned repositories merely because those users are organization members, nor can they configure repositories owned by users outside the organization. Organization owners can also enable secret scanning across multiple organization repositories through security configurations. Accordingly, the supported scope described by the question is existing private repositories owned by the administrator's organization.

A Dependabot alert is only marked as resolved when the related vulnerability is no longer present in your code — specifically after you merge a pull request that updates the vulnerable dependency.

Simply viewing alerts or graphs does not affect their status. Ignoring the alert by leaving the repo unchanged keeps the vulnerability active and unresolved.

Enabling the dependency graph allows GitHub to analyze supported manifest and lock files and build a representation of the repository's direct and transitive dependencies. GitHub receives read-only access to the dependency files, parses supported manifests when the feature is first enabled, and then updates the graph as repository content changes. Dependabot alerts and Dependabot security updates are separate capabilities: enabling the dependency graph alone does not automatically mean that security-update pull requests will be generated. Likewise, the dependency graph setting for one repository does not require administrators to manually enable dependency information for every newly created repository unless their organization's configuration requires that behavior. Therefore, the applicable result among the supplied options is that repository administrators can view the dependency information exposed by the dependency graph.