In GitHub Advanced Security, what is an advisory and how does Dependabot use advisories?

• A. It records a vulnerability; Dependabot uses advisories to determine fixes and create updates.
• B. It defines user roles for security responders within the repo.
• C. It stores policy guidelines for incident response.
• D. It tracks performance metrics of security scans.

Answer: (A)

Advisories are formal vulnerability records published in GitHub’s Security Advisory Database. They describe a flaw in a package, which versions are affected, which versions fix it, and often include references and severity information. Dependabot uses these advisories as the source of truth for vulnerabilities in your dependencies. When a dependency in your project matches an advisory’s vulnerable range, Dependabot uses the advisory to determine the appropriate fixed version and then creates automated updates (pull requests) to upgrade to a non-vulnerable version. This is why advisories exist: they provide the vulnerability details and the remediation path that tools like Dependabot can act on.