3Configure and Use Supply Chain Security

• 3.1Managing Dependency Risk — Dependency Graph, SBOM, and Dependabot

  Understand generating/interpreting the dependency graph, SBOM usage/formats/export, Dependabot vulnerability alerts and security updates, EPSS-based prioritization, and remediation via campaigns and pull requests.

• 3.2Dependency Review, Update Rules, Policies, and Integrations

  Understand pre-merge Dependency Review (license/compliance validation, configuration), advanced dependency update rules (grouping, auto-dismiss, update strategies), permissions and role-based alert assignment, workflow management, and external notifications/webhooks/security integrations.