What is Dependency Graph, and why is it required for Dependency Review and Dependabot?

• A. The Dependency Graph maps a repository’s dependencies; it is required to identify vulnerable components and suggest updates.
• B. It tracks issues by label
• C. It lists all contributors
• D. It is optional and only used for license scanning

Answer: (A)

Dependency Graph maps a repository’s dependencies, showing direct and transitive relationships and the versions involved. This is what enables Dependency Review to see exactly what would be added or changed in a PR and to surface any security or licensing implications tied to those dependencies. It also powers Dependabot by providing a complete dependency tree that can be checked against vulnerability databases and used to propose compatible, safe updates. Without this graph, the service wouldn’t know which components exist, how they connect, or how updates propagate through the tree, so vulnerability checks and update suggestions wouldn’t be reliable.