What does the dependency-review-action (dependency review) primarily enforce on pull requests?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Dependency review gates pull requests that introduce vulnerable or policy-breaking dependencies via manifest diffs. It is not CODEOWNERS, history rewriting, or billing control.
Full explanation below image
Full Explanation
GitHub Dependency review analyzes changes to supported manifest and lockfiles in a pull request, comparing the dependency graph before and after. Integrated with the dependency-review-action in Actions, it can fail the check when new vulnerabilities appear or when licenses/packages violate configured policies. That shifts supply-chain risk left into PR CI. It does not auto-approve docs PRs, rewrite history, or change billing for forks. Teams often combine dependency review with Dependabot alerts, Dependabot security updates, and export of SBOMs for release artifacts. Configure severity thresholds thoughtfully to avoid drowning in low-signal failures while still blocking critical CVEs.