What's changed: New GH-500 Chapter 3 (dependency risk = dependency graph [direct/transitive], SBOM [SPDX/CycloneDX] export, Dependabot alerts/security updates [auto PRs]/version updates, CVSS+EPSS prioritization; Dependency Review & policies = pre-merge gate/license validation, grouping/auto-dismiss/dependabot.yml update strategy, permissions/roles/workflows, webhooks/integrations)
3.2Dependency Review, Update Rules, Policies, and Integrations
Understand pre-merge Dependency Review (license/compliance validation, configuration), advanced dependency update rules (grouping, auto-dismiss, update strategies), permissions and role-based alert assignment, workflow management, and external notifications/webhooks/security integrations.
Against detection (prior section), this section covers prevention/gating ("don’t introduce / don’t let pass") and operational settings in an org. Central are Dependency Review for pre-merge checks, tuning Dependabot update rules, and configuring permissions, notifications, and integrations.
3.2.1Dependency Review — a pre-merge gate
Dependency Review inspects a PR’s diff of added/updated dependencies to check before merge whether vulnerable or license-problematic dependencies are about to be merged (gate-based prevention). As a required check, it can block merges that add risky dependencies. With license/compliance validation, you can reject dependencies under disallowed licenses. This enables "stop before it enters" rather than "fix after it’s in."
3.2.2Dependency update rules (grouping, auto-dismiss)
Many Dependabot PRs can overwhelm operations. Grouping combines related dependency updates into a single PR to cut noise and review load. Auto-dismiss automatically dismisses low-risk alerts (e.g., affecting only dev dependencies) based on conditions. Update strategies set scope (semver ranges), schedule, and target packages in dependabot.yml. These control "the volume of remediation."
3.2.3Permissions, workflows, and integrations
Organizations control who views/acts on alerts via permissions and role-based assignment. Remediation is embedded in workflows (PR review, required checks, CI), mixing human and automated steps. Additionally, external notifications, webhooks, and security integrations route detections to SIEM, issue trackers, or chat, integrating with existing operations. This brings supply-chain posture into organizational security operations.
Common: (1) Dependency Review inspects a PR’s dependency diff before merge (blocks vulnerable/license-problematic deps) = gate-based prevention; license/compliance validation rejects disallowed licenses. (2) Grouping combines update PRs to cut noise; auto-dismiss drops low-risk alerts; dependabot.yml sets update strategy. (3) Permissions/role-based assignment, workflows, webhooks/integrations integrate into org operations.
Watch out: (1) Dependency Review (pre-merge gate on a PR) and Dependabot alerts (detection on existing deps) have different roles—use both. (2) Auto-dismiss is handy, but too-loose conditions dismiss real risk. (3) Grouping reduces noise, but over-grouping can let one failure block the whole batch—design the granularity. (4) Webhooks/integrations extend notification, not perform remediation.
3.2.4Section summary
- Dependency Review = pre-merge inspection of a PR’s dependency diff (block vulnerable/license issues) = gate-based prevention
- Grouping combines update PRs; auto-dismiss drops low-risk; dependabot.yml sets update strategy
- Integrate via permissions/role-based assignment, workflows, and webhooks/integrations
- Dependency Review (pre-merge gate) and Dependabot alerts (existing-dep detection) differ—use both
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. You want to block a PR before merge if newly added dependencies have vulnerabilities or disallowed licenses. What do you use?
Q2. Dependabot update PRs flood and reviews can’t keep up. What setting reduces noise appropriately?
Q3. You want to auto-dismiss low-risk alerts (affecting only dev dependencies) based on conditions. What do you use?
Q4. Which file configures the scope and schedule of Dependabot version updates?
Q5. You want to route detected supply-chain alerts to your SIEM/issue tracker to integrate with existing operations. Appropriate means?
Q6. Which correctly distinguishes the roles of Dependency Review and Dependabot alerts?