依赖项审查帮助您了解依赖项变化以及这些变化在每个拉取请求中的安全影响。 它提供了一个易于理解的依赖项变化视图，多差异显示在拉取请求的“Files Changed（更改的文件）”选项卡上。 依赖项审查告知您：
If a pull request targets your repository's default branch and contains changes to package manifests or lock files, you can display a dependency review to see what has changed. The dependency review includes details of changes to indirect dependencies in lock files, and it tells you if any of the added or updated dependencies contain known vulnerabilities.
Sometimes you might just want to update the version of one dependency in a manifest and generate a pull request. However, if the updated version of this direct dependency also has updated dependencies, your pull request may have more changes than you expected. The dependency review for each manifest and lock file provides an easy way to see what has changed, and whether any of the new dependency versions contain known vulnerabilities.
By checking the dependency reviews in a pull request, and changing any dependencies that are flagged as vulnerable, you can avoid vulnerabilities being added to your project. For more information about how dependency review works, see "Reviewing dependency changes in a pull request."
For more information about configuring dependency review, see "Configuring dependency review."
Dependabot 警报 will find vulnerabilities that are already in your dependencies, but it's much better to avoid introducing potential problems than to fix problems at a later date. For more information about Dependabot 警报, see "About Dependabot 警报."
Dependency review supports the same languages and package management ecosystems as the dependency graph. For more information, see "About the dependency graph."
For more information on supply chain features available on GitHub Enterprise Cloud, see "About supply chain security."
The dependency review feature becomes available when you enable the dependency graph. For more information, see "Enabling the dependency graph."
Note: The 依赖项审查 GitHub Action is currently in public beta and subject to change.
The action is available for all public repositories, as well as private repositories that have GitHub Advanced Security enabled.
You can use the 依赖项审查 GitHub Action in your repository to enforce dependency reviews on your pull requests. The action scans for vulnerable versions of dependencies introduced by package version changes in pull requests, and warns you about the associated security vulnerabilities. This gives you better visibility of what's changing in a pull request, and helps prevent vulnerabilities being added to your repository. For more information, see
By default, the 依赖项审查 GitHub Action check will fail if it discovers any vulnerable packages. A failed check blocks a pull request from being merged when the repository owner requires the dependency review check to pass. For more information, see "About protected branches."
The action uses the Dependency Review REST API to get the diff of dependency changes between the base commit and head commit. You can use the Dependency Review API to get the diff of dependency changes, including vulnerability data, between any two commits on a repository. For more information, see "Dependency review."
You can configure the 依赖项审查 GitHub Action to better suit your needs. For example, you can specify the severity level that will make the action fail, or set an allow or deny list for licenses to scan. For more information, see "Configuring dependency review."