GitHub · Pull requests · Dependency review · Checked October 27, 2026

GitHub: the dependency review check failed

The dependency review action scans the dependency changes in a pull request and raises an error if any new dependencies have known vulnerabilities. By default its check fails if it discovers any vulnerable packages, and a failed check blocks the pull request from being merged when the repository owner requires the check to pass (GitHub's dependency review, checked October 27, 2026).

- name: Dependency Review
  uses: actions/dependency-review-action@v4
  with:
    fail-on-severity: moderate
    deny-licenses: LGPL-2.0, BSD-2-Clause
    fail-on-scopes: development

Why the check failed

A vulnerable dependency: a dependency the pull request adds or updates has a known vulnerability, indirect dependencies in lock files included. The action gets the dependency changes between the base commit and the head commit from the dependency review REST API.
The severity and the scope: fail-on-severity (critical, high, moderate or low) sets the severity of vulnerability that fails the check, and fail-on-scopes (development, runtime, unknown) the scopes in which a vulnerability blocks the pull request (GitHub's configuring the dependency review action).
A license: allow-licenses (only these) or deny-licenses (block these), never both, make the check fail on a dependency whose license is not allowed. A license policy enforced by a ruleset is a different rule: see license compliance results.
Missing data: the action also considers dependencies sent with the dependency submission API. Run the submission in the same workflow as the dependency review; if it runs separately, set retry-on-snapshot-warnings to true and retry-on-snapshot-warnings-timeout to slightly more seconds than the longest submission takes.

Who requires it

The branch: the dependency review check is one of the status checks a protected branch can require to pass before merging (GitHub's about protected branches).
The organization: an organization owner can enforce it with a repository ruleset whose rule "Require workflows to pass before merging" names the workflow that runs dependency review; pull requests merge only once it passes (GitHub's enforcing dependency review across an organization).
Where it runs: dependency review becomes available when the dependency graph is enabled. The action is available for all public repositories, and for private repositories with GitHub Code Security or GitHub Advanced Security enabled.

Seeing what changed

The rich diff: on the Files changed tab, the File filter can collapse the files that do not record dependencies, and the file icon on the right of a manifest or lock file displays its dependency review (GitHub's reviewing dependency changes in a pull request).
The warning: dependencies with vulnerabilities come first, by severity. Each warning gives a brief description, a CVE or GHSA ID, the severity, and the version of the dependency in which the vulnerability was fixed.
What it leaves out: rich diffs are not available for committed static JavaScript files like jquery.js, and dependencies GitHub cannot parse do not appear, so check the source diff too.
The REST API: GET /repos/OWNER/REPO/dependency-graph/compare/BASE...HEAD returns each added or removed dependency with its manifest, version, license, scope and vulnerabilities. It answers 403 for a private repository without GitHub Advanced Security, or when used against a fork.

What to do

Update the dependency: move it to the version the warning names as fixed, or a later release, and push.
Skip one advisory: allow-ghsas lists GitHub Advisory Database IDs the action skips during detection. It is set in the workflow or its configuration file.
Change the threshold: GitHub suggests failing on fail-on-severity, to balance security with low friction for developers, and blocking licenses rather than listing the allowed ones (GitHub's customizing the dependency review action).
A check that never reports: the workflow the Actions tab sets up runs on pull requests to main (branches: [ "main" ]). A required check that does not run waits as expected: see required check expected.

GitHub pull requests in IntelliJ IDEA

Pull Request Inbox for GitHub, a plugin by Lesstep for JetBrains IDEs 2024.1 or later, shows a pull request's reviews, checks and conversations next to the diff, and merges it with the methods the target branch allows. It lists each check on the head commit with its name, the title of its result and a link to it on GitHub, and its merge checks say when the rules of the branch hold the merge back. Manifest and lock files appear as source diffs, not as GitHub's dependency review. The review inbox, diffs and conversations are free; approving, commenting, resolving and merging are Pro (US$1.50 a month, with a 30-day trial).

GitHub is a trademark of GitHub, Inc.; IntelliJ IDEA is a trademark of JetBrains s.r.o. This page is not affiliated with or endorsed by GitHub, Inc. or JetBrains.