actions/dependency-review-action

View on GitHub

A GitHub Action for detecting vulnerable dependencies and invalid licenses in your PRs

Stars: 893
Forks: 183
Open beginner issues: 0
Indexed issues: 24
Avg merge: 1d 19h
Merged PRs (30d): 5

Dominant language: TypeScript
License: MIT
Last GitHub push: Sep 5, 2026
Latest indexed: Sep 20, 2026
Contributing guide: Contributing guide
Code of conduct: Code of conduct
Beginner labels: No beginner labels indexed

Beginner friendly Everything

Open All

24 open issues indexed

[BUG] Developer dependency reports documentation license as well Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 48/100

actions/dependency-review-action#1145 · Opened Sep 2, 2026
Wrong license reported for `strtok3@10.3.5` Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 68/100

actions/dependency-review-action#1143 · 1 comment · Opened Aug 14, 2026
base-ref accepts an abbreviated commit SHA and silently returns an empty comparison Open

Difficulty 4/5 3-5 days Newbie friendliness 48/100

actions/dependency-review-action#1142 · Opened Aug 12, 2026
[BUG] Dependency graph API returns null license for all un-pinned version specifiers (e.g. pyproject.toml ranges) Open

bug

actions/dependency-review-action#1135 · 1 reaction · 2 assignees · Opened Jul 24, 2026
PR Comments remain when issues have cleared Open

enhancement

Difficulty 3/5 1-2 days Newbie friendliness 55/100

actions/dependency-review-action#1127 · 8 reactions · Opened Jul 15, 2026
[BUG] Multilicense packages are not approved even if an accepted license is one of them Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 62/100

actions/dependency-review-action#1125 · Opened Jul 7, 2026
exclude or whitelist certain dependencies Open

enhancement

Difficulty 4/5 3-5 days Newbie friendliness 45/100

actions/dependency-review-action#1118 · Opened Jun 18, 2026
[BUG] Recently updated NPM packages show "Unknown License" Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 55/100

actions/dependency-review-action#1115 · 3 comments · Opened Jun 7, 2026
Idk what I'm doing Open

enhancement

Difficulty 5/5 Over a week Newbie friendliness 10/100

actions/dependency-review-action#1113 · 2 reactions · Opened Jun 4, 2026
[BUG] swagger-ui-dist listed as MPL-2.0, but all sources seem to say it's Apache License 2.0 Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 55/100

actions/dependency-review-action#1105 · Opened May 20, 2026
[BUG] Update actions/dependency-review-action from 4 to 5 breaks on Unknown License Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 45/100

actions/dependency-review-action#1099 · 3 comments · Opened May 10, 2026
Downgrade "skipping comment creation" message from warning to info Open

enhancement

Difficulty 1/5 Under an hour Newbie friendliness 78/100

actions/dependency-review-action#1090 · 1 reaction · Opened Apr 30, 2026
[BUG] dependency-review-action flags different vulnerabilities for identical inputs across workflows Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 50/100

actions/dependency-review-action#1085 · Opened Apr 8, 2026
Allow licenses by groups Open

enhancement Stale

Difficulty 4/5 3-5 days Newbie friendliness 52/100

actions/dependency-review-action#1068 · 1 comment · Opened Mar 12, 2026
Allow configuring a proprietary non-SPDX-listed license Open

enhancement

Difficulty 5/5 Over a week Newbie friendliness 35/100

actions/dependency-review-action#1038 · 3 comments · Opened Jan 13, 2026
Add ability to block recently published packages (cooldown feature) Open

enhancement

Difficulty 5/5 Over a week Newbie friendliness 45/100

actions/dependency-review-action#1023 · 2 comments · 4 reactions · Opened Nov 25, 2025
Support looking up snapshot Open

enhancement

Difficulty 4/5 3-5 days Newbie friendliness 45/100

actions/dependency-review-action#985 · 2 comments · Opened Sep 26, 2025
[BUG] Vulnerability, License and ScoreCard Info missing for API Dependency Submission Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 48/100

actions/dependency-review-action#923 · 5 comments · 2 reactions · Opened Apr 26, 2025
Scan the result of merge instead of diff Open

enhancement

Difficulty 4/5 3-5 days Newbie friendliness 45/100

actions/dependency-review-action#922 · 4 comments · 1 reaction · Opened Apr 17, 2025
Add list of resolved vulnerabilities to the PR Comment / Logs Open

enhancement

Difficulty 4/5 3-5 days Newbie friendliness 45/100

actions/dependency-review-action#717 · 12 comments · 11 reactions · Opened Mar 20, 2024
Add configuration option to fail a run if we encounter unknown licenses Open

enhancement

Difficulty 3/5 1-2 days Newbie friendliness 55/100

actions/dependency-review-action#672 · 15 comments · 4 reactions · Opened Jan 26, 2024
Handle API errors / rate limits more gracefully Open

bug enhancement Keep

Difficulty 3/5 1-2 days Newbie friendliness 45/100

actions/dependency-review-action#555 · Opened Aug 28, 2023
Allow ignoring particular sources of dependencies Open

enhancement Keep

Difficulty 4/5 3-5 days Newbie friendliness 35/100

actions/dependency-review-action#459 · 1 comment · Opened Apr 19, 2023
Properly handle 502s from Dependency Review API Open

enhancement Keep

Difficulty 3/5 1-2 days Newbie friendliness 48/100

actions/dependency-review-action#398 · 3 comments · 14 reactions · Opened Feb 8, 2023

actions/dependency-review-action

Get new issues in your inbox