actions/Dependency Review
Prevent the introduction of dependencies with known vulnerabilities
View on GitHubTrust Signals
- Scorecard Score
- Scorecard 6–8scored Jul 13, 2026
- Maintenance Recency
- Activelast commit Jul 3, 2026
- License
- MIT
Pinned Snippet
uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| repo-token | Token for the repository. Can be passed in using `{{ secrets.GITHUB_TOKEN }}`. | no | ${{ github.token }} |
| fail-on-severity | Don't block PRs below this severity. Possible values are `low`, `moderate`, `high`, `critical`. | no | — |
| fail-on-scopes | Dependency scopes to block PRs on. Comma-separated list. Possible values are 'unknown', 'runtime', and 'development' (e.g. "runtime, development") | no | — |
| base-ref | The base git ref to be used for this check. Has a default value when the workflow event is `pull_request` or `pull_request_target`. Must be provided otherwise. | no | — |
| head-ref | The head git ref to be used for this check. Has a default value when the workflow event is `pull_request` or `pull_request_target`. Must be provided otherwise. | no | — |
| config-file | A path to the configuration file for the action. | no | — |
| allow-licenses | Comma-separated list of allowed licenses (e.g. "MIT, GPL 3.0, BSD 2 Clause") | no | — |
| deny-licenses | Comma-separated list of forbidden licenses (e.g. "MIT, GPL 3.0, BSD 2 Clause") | no | — |
| allow-dependencies-licenses | Comma-separated list of dependencies in purl format (e.g. "pkg:npm/express, pkg:pypi/pycrypto"). These dependencies will be permitted to use any license, no matter what license policy is enforced otherwise. | no | — |
| allow-ghsas | Comma-separated list of allowed GitHub Advisory IDs (e.g. "GHSA-abcd-1234-5679, GHSA-efgh-1234-5679") | no | — |
| external-repo-token | A token for fetching external configuration file if it lives in another repository. It is required if the repository is private | no | — |
| license-check | A boolean to determine if license checks should be performed | no | — |
| vulnerability-check | A boolean to determine if vulnerability checks should be performed | no | — |
| comment-summary-in-pr | Determines if the summary is posted as a comment in the PR itself. Setting this to `always` or `on-failure` requires you to give the workflow `pull-requests: write` permissions | no | — |
| deny-packages | A comma-separated list of package URLs to deny (e.g. "pkg:npm/express, pkg:pypi/pycrypto"). If version specified, only deny matching packages and version; else, deny all regardless of version. | no | — |
| deny-groups | A comma-separated list of package URLs for group(s)/namespace(s) to deny (e.g. "pkg:npm/express/, pkg:pypi/pycrypto/"). Please note that the group name must be followed by a `/`. | no | — |
| retry-on-snapshot-warnings | Whether to retry on snapshot warnings | no | — |
| retry-on-snapshot-warnings-timeout | Number of seconds to wait before stopping snapshot retries. | no | — |
| warn-only | When set to `true` this action will always complete with success, overriding the `fail-on-severity` parameter. | no | — |
| show-openssf-scorecard | Show a summary of the OpenSSF Scorecard scores. | no | — |
| warn-on-openssf-scorecard-level | Numeric threshold for the OpenSSF Scorecard score. If the score is below this threshold, the action will warn you. | no | — |
| show-patched-versions | When set to `true`, the vulnerability summary table will include a column showing the first patched version for each vulnerability. | no | — |
Outputs
| name | description |
|---|---|
| comment-content | Prepared dependency report comment |
| dependency-changes | All dependency changes (JSON) |
| vulnerable-changes | Vulnerable dependency changes (JSON) |
| invalid-license-changes | Invalid license dependency changes (JSON) |
| denied-changes | Denied dependency changes (JSON) |