►
From YouTube: Helps reviewers and contributors understand dependency changes in every PR - GitHub Checkout
Description
Show Notes
Dependency Review is a new GitHub Advanced Security feature that allows you to view a “rich diff” of what has changed in your dependency manifest file while reviewing a pull request. With Dependency Review, you can easily see any new, changed or removed dependency, including their age, license information, and vulnerability information.
In this video, Maya Kaczorowski and Sasha Rosenbaum walk us through the details of what the feature can do for you, and show a quick demo of the feature.
5:10 - demo: working with Dependency Review
Dependency Review docs:
https://github.co/dependency-review
Maya Kaczorowski:
GitHub - https://github.com/mayakacz
Twitter - https://twitter.com/MayaKaczorowski
Sasha Rosenbaum:
GitHub - https://github.com/DivineOps
Twitter - https://twitter.com/DivineOps
Presented by
For more from GitHub Universe 2020, visit https://githubuniverse.com
As always, feel free to leave us a comment below and don't forget to subscribe: http://bit.ly/subgithub
Thanks!
Connect with us.
Facebook: http://fb.com/github
Twitter: http://twitter.com/github
LinkedIn: http://linkedin.com/company/github
About GitHub
GitHub is the best place to share code with friends, co-workers, classmates, and complete strangers. Millions of people use GitHub to build amazing things together. For more info, go to http://github.com
A
B
Sure
so,
when
you're
introducing
new
dependencies
into
your
environment
as
part
of
a
pull
request
so
to
a
change
to
a
manifest
file
or
a
lock
file
dependency
review
lets
you
see
what
the
changes
that
you're
making
to
those
dependencies
are.
So
you
can
better
understand
whether
or
not
you
want
to
merge
that
pull
request.
A
B
Dependable
sends
you
an
alert
after
the
fact,
so
after
you've
merged
a
dependency
that
it
that
has
a
depend
vulnerability.
What
sends
you
an
alert
dependency
review,
tells
you
before
you've
actually
merged
in
that
dependency,
so
you
can
choose
to
to
never
introduce
that
vulnerability
to
begin
with
dependent
bot.
I
want
to
point
out
also
sends
you
a
pr
so
after
the
fact
that
it
does
send
you
pr,
independent
will
also
send
you
an
alert
if
there's
a
new
vulnerability.
A
B
You
can
see
lots
of
information
about
the
the
what
I
would
think
of
as
the
risk
of
your
dependency,
so
you
can
see
what
dependencies
you're,
adding
modifying
or
removing
and
for
each
of
those
how
old
it
is.
If
it's
introducing
any
new
vulnerabilities,
how
many
dependents
it
has
and
the
license
that
it's
using
and
that
information
together
helps
you
determine
whether
or
not
you
want
to
have
that
in
your
environment,
because
you
might
have
restrictions
in
your
environment
around
some
of
those,
some
of
those
some
of
that
metadata.
B
Some
of
those
things
you
want
to
keep
keeping
score
in
your
environment
or
you
might
not
want
to
to
take
a
dependency
on
something
that
you
don't
know
where
it
comes
from,
and
so
better
understanding
a
little
bit
more
about
that
dependency.
Helps
you
decide
whether
or
not
it
should
be
in
your
environment.
A
B
B
Another
situation
might
be
that
you're.
You
know
making
lots
of
small
changes,
which
is
a
good,
a
good
principle
in
general
in
code
development.
So
if
you
are
making
a
small
change
to
do
a
minor
upgrade
and
then
you
know
testing
things
out
and
then
you
plan
on
keep
upgrading.
That's
also
a
good
reason
to
upgrade
to
a
vulnerable
version,
to
kind
of
get
out
of
your
current
state
and
into
a
better
state.
B
A
B
With
read,
access
to
your
repo
can
see
dependency
review,
so
they
can
see
information
about
the
changes
that
you're
making
in
a
pr.
It's
really
important
to
note
here
that
they're
not
seeing
vulnerability
information
after
the
fact
so
they're
not
seeing
what
you
did
introduce
in
your
environment.
It's
a
static
moment
in
time.
It
doesn't
necessarily
apply
to
your
current
environment.
B
B
You
don't
really
need
to
so.
If
you're
already
using
a
dependency
graph
dependency
review,
just
works
dependency
graph
is
enabled
on
all
public
repos
by
default,
and
actually
you
can't
turn
it
off,
because
that's
how
we
keep
track
of
who's,
relying
on
what
and
for
private
repos
you
can
enable
dependency
graph,
and
once
you
enable
dependency
graph
dependency
review,
just
works.
A
B
B
Let's
go
deal
with
that
first,
so
I
have
a
pull
request
from
you
know
myself
very,
very
practical
here
where
I'm
changing
a
manifest
file
and
in
this
pull
request,
you'll
see
in
the.
In
the
normal
view
of
this
pull
request
of
the
files
changed
you'll
see,
I'm
upgrading
a
version
of
a
dependency,
I'm
a
great
upgrading
version
of
another
dependency
and
I'm
adding
a
dependency.
So
actually,
what
I
was
doing
here
was,
I
was
trying
to
add
this
new
dependency
that
I
have
here.
B
Vertex
unit
and
then
I
wanted
to
just
upgrade
these
other
two
while
I
was
at
it
because
you
know
they
should
probably
be
in
sync
sounds
good.
So
if
I
go
over
to
the
rich
diff
button
here
and
I
hit
that
what
I
actually
get
is
this
brand
new
view,
which
is
way
easier
to
read
than
what
I
was
looking
at
before.
That
tells
me
that
I've
changed
a
couple
of
dependencies
and
I've
added
a
dependency
and
for
the
dependencies
that
I've
changed.
B
Some
of
them
have
vulnerabilities,
so
you
know
vertex
web
here
has
a
high
severity
and
a
low
severity
vulnerability.
Vertex
core
has
a
moderate
and
a
low
and
the
versions
that
I'm
upgrading
to
not
only
are
they
super
old,
but
they're,
not
the
patched
versions.
That's
not
good!
I
can
also
see
what
license
information
I
have
for
the
the
vulnerabilities
that
I'm
using
in
this
sorry
the
dependencies
that
I'm
using
in
this
environment.
B
B
Well,
I
changed
the
3.3.4,
so
5.4,
sorry,
5.4
and
I'll
just
commit
that
directly
to
the
branch
that
I'm
looking
at
and
yeah.
That
looks
good
to
me.
Okay,
let's
go
over
to
my
dependency
review
and
dependency
review,
says
yep
you're,
adding
one
dependency,
which
is
what
I
was
trying
to
do
and
I
modified
to
my
other
dependencies
and
that's
it
there's
no
other
vulnerability
information
here
as
to
what
I'm
adding
that
looks
great,
I'm
good.
I
feel
I
feel
comfortable
merging
this.
I
mean
you
know.
B
Obviously
I'm
going
to
run
my
my
test
suite
against
it,
but
I
feel
pretty
comfortable
saying
this
is
good
to
go.
Let's,
let's
merge
that
in
so
let's
do
that
whoo!
The
other
thing
that's
really
cool
here
about
dependency
review
is
you
know
I
talked
about
all
these
security
issues.
I
had
to
work
on
earlier
that
I
wasn't
going
to
let's
go
over
that.
Well,
first
thing:
I
don't
know
if
you
notice
a
flash
second
there.
I
had
14
security
issues
before
and
now
I
have
12.
that's
because
I
actually
just
fixed
two
of
them.
A
B
B
B
A
B
So
no
dependency
review
just
tells
you
whether
or
not
something
has
a
vulnerability,
and
we
tell
you
where
the
patch
version,
what
patch
version
you
need
to
be
able
to
fix
that
vulnerability.
It
doesn't
yet.
You
know,
provide
a
commit
to
your
to
your
pr,
we're
not
at
that
stage
or
suggest
alternative
dependencies,
we're
not
there
either,
but
hopefully
for
now.
That
should
be
good
enough
for
you
to
go
in
and
edit
the
file
and
start
making
those
changes
yourself.
A
B
That's
not
possible
today
either,
but
that's
definitely
where
we're
heading
we're
hearing
a
lot
of
interest
for
that.
So
this
is
really
the
first
step
of
being
able
to
see
what
you're
what's
changing
your
environment
from
a
security
point
of
view.
So
then
you
can
control.
What's
changing
your
environment
from
a
security
point
of
view,
yeah
I
have
nothing.
I
have
nothing
else
to
say.