What will happen if Dependabot discovers a vulnerable transitive dependency in a repository?

It creates a pull request to update the direct dependency to a version that resolves the vulnerability.

It opens a pull request to update the affected package directly, regardless of version compatibility.

It automatically removes the package from the repository.

It sends an email to the repository owner but does not alter code.