AI / Dependabot Interview questions
What is a Dependabot alert?
A Dependabot alert is the notification GitHub raises when a repository's dependency graph shows it depends on a package version with a known security vulnerability — visible in the repository's "Security" tab under "Dependabot alerts," listing the affected dependency, the vulnerability's severity, and (if available) a patched version that resolves it.
Security > Dependabot alerts - lodash 4.17.15 (High severity) - Prototype Pollution Patched version: 4.17.21
An alert on its own doesn't change any code — it's purely informational, surfacing the risk for a maintainer to act on. If Dependabot security updates are enabled, an alert typically also triggers an automatic pull request proposing the fix, but the alert itself exists independently as a persistent record even if that automated PR is closed or the update is handled manually instead.
More Related questions...
