Question

Your team has enabled the Dependency Review Action on pull requests. Security wants the check to block any PR that introduces a dependency with a GPL-3.0 license, but they want vulnerability-based failures to only trigger on 'high' severity or above. A developer opens a PR that adds a new package licensed under MIT that has a 'moderate' severity vulnerability. What is the expected result of the Dependency Review Action run, assuming it is configured with 'deny-licenses: GPL-3.0' and 'fail-on-severity: high'?

Accepted Answer

The check passes because the license is not denied and the vulnerability is below the fail-on-severity threshold.

Answer

The check fails because any newly introduced vulnerability, regardless of severity, causes a failure.

Answer

The check fails because MIT is not on an explicit allow-list, so all non-listed licenses are blocked by default.

Answer

The check is skipped entirely because moderate vulnerabilities are ignored and license rules only apply to production dependencies.