GitHub · GH-100
Dependabot, advisories, and the response plan
GH-100 · Lesson 10 of 17 · 1:23:13
YouTube loads only after you press play. This chapter opens at its timestamp in the full course. Watch on YouTube ↗
In this lesson
Prepare for the GH-100 exam (GitHub Administration). In this lesson: the dependency graph and Dependabot alerts, security and version updates with dependabot.yml, repository security advisories, CVE identifiers, and private vulnerability reporting, SECURITY.md, a security response plan, and managing alerts at enterprise scale. Includes three original practice questions.
Preview the topics
- Contoso wants pull requests that update the npm packages of its web store every week, even when no vulnerability is known. What should the team add?
- A researcher found a flaw in Contoso’s public charging library, and wants to report it to the maintainers without making it public. What should the maintainers enable?
- Contoso fixed a vulnerability in its public charging library in private, and released the patch. How do the library’s users learn that they must upgrade?