What should Dependency Review summarize in a PR?

• A. A summary of changes to dependencies, including security and policy notes.
• B. A summary of unit test results.
• C. A list of unrelated code quality metrics.
• D. A design document.

Answer: (A)

Dependency Review focuses on how a PR changes the project's dependencies and what that means for security and policy. It should summarize which dependencies were added, removed, or updated, including the exact versions and any changes in transitive dependencies. It should call out any security advisories tied to those dependencies, indicate if the updates address known vulnerabilities, and note any new vulnerabilities that could be introduced. It should also surface licensing and policy notes—whether the dependencies’ licenses are allowed under policy, any changes in license terms, and whether the update passes policy checks. This helps reviewers quickly assess supply chain risk and compliance before merging.