Copilot Code Review excludes dependency management files which hinders analysis of newly introduced deps

The docs here state that they are excluded https://docs.github.com/en/copilot/concepts/agents/code-review#excluded-files

But it would be highly appropriate for the agent to scan the files for newly introduced deps that could potentially include malware and also flag vulnerable dependencies, suggest alternative packages, surface deprecation info, support status etc.

Start with the linked Copilot Code Review documentation, especially the excluded-files section, to understand the current dependency-file behavior. Define the dependency-management file types and analysis outcomes covered by the request, including newly introduced dependencies, malware or vulnerability warnings, alternatives, deprecation, and support status; done means the behavior is specified and validated for those cases.

Vom Indexierungsmodell aus dem Issue-Text verfasst.