A maintainer has fixed a vulnerability privately in their open-source project and now wants the fix to feed GitHub's vulnerability detection so that downstream consumers of the package start receiving Dependabot alerts. They are working from a repository security advisory they drafted during the embargo. After they publish that advisory, what is the primary mechanism by which downstream repositories begin to be alerted?
- APublishing the advisory adds it to the GitHub Advisory Database, where Dependabot matches it against the resolved dependency versions in downstream dependency graphs to raise alerts. Correct
- BPublishing the advisory triggers GitHub to push a security update pull request directly into every downstream repository that depends on the package.
- CPublishing the advisory emails the security contacts of every downstream repository, which is what creates the alert in those repositories.
- DPublishing the advisory immediately yanks the vulnerable package versions from the registry so downstream builds fail until they upgrade, which surfaces the issue.
Why A is correct: A published repository security advisory is reviewed into the GitHub Advisory Database, and Dependabot compares those advisories against each repository's dependency graph data, so downstream consumers on affected versions receive alerts.
Why B is wrong: This is tempting because remediation pull requests are a real feature, but GitHub does not push fixes into other people's repositories on publication; each downstream repository only gets a security update pull request if it has Dependabot security updates enabled for itself.
Why C is wrong: Notifications may reach maintainers of affected repositories, but the alert itself is created by matching the advisory against the dependency graph, not by an email, so email is a side effect rather than the alerting mechanism.
Why D is wrong: GitHub advisories do not remove or yank packages from external registries; the advisory records affected version ranges and powers alerting, while yanking a release is a separate action only the package owner can take on the registry.