What does GitHub's 'dependency review' feature provide in pull requests?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Dependency review in PRs is your pre-merge vulnerability gate. Before you merge a PR that bumps dependencies, GitHub shows you a visual diff: 'You're adding lodash 4.17.19 which has a known high-severity vulnerability.' Catch it before it lands.
Full explanation below image
Full Explanation
GitHub's Dependency Review feature (available with GitHub Advanced Security or on public repositories) provides a rich diff view specifically for dependency changes within pull requests. When a PR modifies manifest files (package.json, requirements.txt, etc.), the dependency review: (1) Shows all added and removed dependencies with version information. (2) Highlights any newly introduced dependencies with known security vulnerabilities (from the GitHub Advisory Database), including severity level and CVE. (3) Links to vulnerability details for remediation guidance. (4) Can be configured with a dependency-review-action to block PRs that introduce vulnerable dependencies. This is distinct from Dependabot alerts (which alert on existing deps) — dependency review specifically targets the delta introduced by the PR.