Question

A platform team wants the Dependency Review action to block pull requests only when a newly introduced dependency has a vulnerability rated 'high' or 'critical', while still surfacing lower-severity findings as informational comments without failing the check. Which configuration approach achieves this?

Accepted Answer

Set the `fail-on-severity` input to `high` in the dependency-review-action configuration

Answer

Enable Dependabot security updates and set the alert threshold to 'high' in the repository settings

Answer

Add a branch protection rule requiring the Dependabot alerts check to pass before merging

Answer

Configure the `fail-on-scopes` input to `runtime` so only production dependencies fail the check