Configure dependency review in CI
Implementation Effort: Low – Adding the dependency-review check to pull request pipelines is a targeted, one-time pipeline change.
User Impact: Low – The check runs during pull request validation and surfaces findings to reviewers; end users are not affected.
Lifecycle Stage: Build
Overview
Configure dependency review in pull request pipelines to block vulnerable dependency changes before they reach a protected branch. Open-source dependencies make up the majority of code in modern applications, and new vulnerabilities in those dependencies are disclosed continuously. Without a gate in the pull request workflow, a developer can introduce a dependency with a known critical vulnerability — or upgrade to a version that adds one — and the change merges into the protected branch before anyone realizes the risk.
On GitHub, Dependency Review provides a pull request experience for evaluating dependency changes before merge, and organizations that want blocking policy checks can enforce it by adding the dependency-review-action to a required GitHub Actions workflow. Dependency Review is available for all public repositories and for private or internal repositories that have GitHub Code Security or GitHub Advanced Security enabled. Confirm repository eligibility against your current GitHub plan before making the control mandatory. In Azure DevOps, use the AdvancedSecurity-Dependency-Scanning task in the pull request validation pipeline and enforce the result through branch policies and pull request annotations.
The platforms address the same supply chain risk, but they implement the control differently. GitHub provides a dependency-diff review experience in pull requests, while Azure DevOps relies on pipeline-based dependency scanning results rather than the same native dependency review experience. Both approaches reduce the chance that vulnerable dependency changes reach protected branches. Gating merges on dependency review applies Verify explicitly by validating each dependency change before it is trusted, and it supports Assume breach by treating incoming open-source changes as untrusted until analyzed.