You can use the dependency review action to help enforce dependency reviews on pull requests in your repository. The dependency review action scans your pull requests for dependency changes and raises an error if any new dependencies have known vulnerabilities.
Note: About dependency review
Dependency review helps you understand dependency changes and the security impact of these changes at every pull request. It provides an easily understandable visualization of dependency changes with a rich diff on the "Files Changed" tab of a pull request. Dependency review informs you of:
Which dependencies were added, removed, or updated, along with the release dates How many projects use these components Vulnerability data for these dependencies Dependency review allows you to "shift left". You can use the provided predictive information to catch vulnerable dependencies before they hit production.

Access to Dependabot alerts
You can see all of the alerts that affect a particular project on the repository's Security tab or in the repository's dependency graph.
By default, we notify people with write, maintain, or admin permissions in the affected repositories about new Dependabot alerts.
Write permissionis the minimum levelneeded to be automatically notified.