Stopping vulnerable dependencies before they land
Dependabot is good at catching known vulnerabilities in dependencies you already have. But it can't tell you about a vulnerability in a dependency you haven't added yet. The dependency review action for GitHub Actions closes that gap by checking pull requests for newly introduced dependencies against the GitHub Advisory Database, and failing the check if any of them have known issues.
How the action works
The action scans the dependency changes in a pull request and diffs them against the GitHub Advisory Database. If a newly added dependency has a known vulnerability, the action raises an error that points you to the offending package and provides contextual information to help you implement a fix. Under the hood, the action uses a new API endpoint in the GitHub REST API that diffs dependencies between any two revisions — a capability that previously only powered the rich diff view in the pull request UI.
You can find the action on the GitHub Marketplace or in your repository's Actions tab under the Security heading. It's available for all public repositories, and for private repositories with GitHub Advanced Security licensed.
What's next
The action is currently in public beta. Planned improvements include configurable failure criteria, so you can set thresholds on vulnerability severity or license type before the action fails a pull request. The team is also working on better surfacing of failed action runs in the UI and more flexibility around when the action is executed.
For more details, see the action's repository and the documentation.
