Dependency review shows which dependencies a pull request adds, removes or updates, and flags known vulnerabilities in them. It catches risky changes before merge. It cannot flag a malicious version that nobody has reported yet, so pair it with age rules and monitoring.
What it is
Dependency review is a check on pull requests that change manifests or lock files. GitHub's documentation says it covers added, removed and updated dependencies with release dates, how many projects use each component, and vulnerability data, including changes to indirect dependencies in lock files.
What it catches
- A new dependency you did not intend, visible in the lockfile diff.
- A version with a published advisory.
- A suspiciously young release, because release dates are shown.
- A large jump in transitive dependencies from a small manifest change.
What it misses
| Situation | Caught? |
|---|---|
| Known vulnerability in a new version | Yes |
| Brand new malicious version, not yet reported | Not by advisory data alone |
| Dependency confusion on a new internal name | Only if source information is checked |
| Change outside manifests, such as a script downloading code | No |
| Workflow or build config changes | No, needs separate review |
Making it effective
- Make it required. A check that can be ignored will be.
- Review the lockfile, not just the manifest. Transitive changes live there.
- Add a policy on release age. Treat very new versions as needing a human look.
- Block by policy, with an exception path. Severity and license rules fit well, and a named approver handles exceptions.
- Review workflow changes with the same care. Changes to CI definitions are dependency changes in effect.
Choosing a tool for this step
Questions to ask any vendor:
- Does the check run on every pull request, and how long does it take?
- Does it read lockfiles for exact transitive versions?
- Can policy use more than severity, such as age, source or license?
- Can a reviewer see why a rule fired?
Try it yourself
Open the demo and watch a pull request gate decide on a change. Look at what evidence the reviewer sees.
Click through it at your own pace, or open it full screen.
Quick check
Is dependency review a replacement for monitoring?
No. It checks a change at merge time. Monitoring catches problems reported afterward in code you already run.
Should every finding block a merge?
Block on the rules you can defend, such as critical severity, and route the rest to review.
Where Safeguard fits
Safeguard offers policies, gates and guardrails for pull requests, with SBOM and dependency scanning. The free scan previews findings on a repository.
Sources
Last reviewed: 19 October 2026.
