Question

A platform team maintains a Node.js monorepo where devDependencies (test runners, linters, build tooling) are numerous and frequently trigger Dependency Review failures on pull requests, blocking merges for vulnerabilities that never ship to production. The security lead wants Dependency Review to still fail the PR check for vulnerable production dependencies but stop failing on issues that only affect development-time packages. Which configuration approach for the Dependency Review action best achieves this?

Accepted Answer

Set the `fail-on-scopes` option to `runtime` so the action only fails the check on vulnerabilities in runtime (production) dependencies

Answer

Add each vulnerable devDependency to `allow-ghsas` so those specific advisories are permanently ignored across all future PRs

Answer

Set `fail-on-severity` to `critical` so lower-severity devDependency alerts no longer block the merge

Answer

Disable the dependency graph for the repository so devDependency manifests are no longer parsed during review