Which statement about Dependabot alerts and Dependabot security updates is accurate?

• A. Alerts notify about known vulnerabilities; updates automatically creates PRs to fix them.
• B. Alerts update the dependencies directly.
• C. Alerts replace the need for manual code review.
• D. Alerts notify about known vulnerabilities; Security updates automatically creates PRs to fix them.

Answer: (D)

Dependabot splits its functionality into alerts and security updates. Alerts warn you when a dependency has a known vulnerability, but they don’t change your code by themselves. Security updates are the automated part that creates pull requests to bump the vulnerable dependency to a patched version. So the statement that alerts notify about known vulnerabilities and security updates automatically create PRs to fix them accurately describes how the two features work together. The other ideas aren’t correct because alerts don’t update dependencies directly, and alerts don’t replace the need for review—the generated PRs (from security updates) still go through review before merging.