Skip to main content

Configuring dependency review

You can use dependency review to catch vulnerabilities before they are added to your project.

About dependency review

Dependency review helps you understand dependency changes and the security impact of these changes at every pull request. It provides an easily understandable visualization of dependency changes with a rich diff on the "Files Changed" tab of a pull request. Dependency review informs you of:

  • Which dependencies were added, removed, or updated, along with the release dates.
  • How many projects use these components.
  • Vulnerability data for these dependencies.

For more information, see "About dependency review" and "Reviewing dependency changes in a pull request."

About configuring dependency review

Dependency review is available when dependency graph is enabled for your GitHub Enterprise Server instance and Advanced Security is enabled for the organization or repository. For more information, see "Enabling GitHub Advanced Security for your enterprise."

Checking if the dependency graph is enabled

  1. On your GitHub Enterprise Server instance, navigate to the main page of the repository.

  2. Under your repository name, click Settings. Repository settings button

  3. In the "Security" section of the sidebar, click Code security and analysis.

  4. Under "Configure security and analysis features", check if the dependency graph is enabled.

  5. If dependency graph is enabled, click Enable next to "GitHub Advanced Security" to enable Advanced Security, including dependency review. The enable button is disabled if your enterprise has no available licenses for Advanced Security. Screenshot of "Code security and analysis" features"

Configuring the dependency review action

Note: The dependency review action is currently in public beta and subject to change.

The dependency review action scans your pull requests for dependency changes and raises an error if any new dependencies have known vulnerabilities. The action is supported by an API endpoint that compares the dependencies between two revisions and reports any differences.

For more information about the action and the API endpoint, see the dependency-review-action documentation, and "Dependency review" in the API documentation.

The following configuration options are available.

fail-on-severityOptionalDefines the threshold for level of severity (low, moderate, high, critical).
The action will fail on any pull requests that introduce vulnerabilities of the specified severity level or higher.

This dependency review action example file illustrates how you can use these configuration options. Notice that the example uses short version number for the action (v2) instead of a semver release number (for example, v2.0.8). This ensures that you use the most recent minor version of the action.

name: 'Dependency Review'
on: [pull_request]

  contents: read

    runs-on: ubuntu-latest
      - name: 'Checkout Repository'
        uses: actions/checkout@v3
      - name: Dependency Review
        uses: actions/dependency-review-action@v2
          # Possible values: "critical", "high", "moderate", "low" 
          fail-on-severity: critical

For further details about the configuration options, see dependency-review-action.