Which option best describes Dependency Review?

• A. It reviews code style in pull requests.
• B. Understands and reviews dependency changes in pull requests, catching vulnerable or out-of-date dependencies.
• C. It handles licensing compliance for dependencies only.
• D. It only works on production dependencies.

Answer: (B)

Dependency Review is about examining any dependencies that would be added or updated by a pull request. It analyzes both direct and indirect dependencies to identify risks like known vulnerabilities, out-of-date versions, or potential licensing issues, so teams can catch problems before merging. This focus on how dependencies change in the PR, rather than code style or other concerns, is what makes the description a precise fit. It isn’t limited to production dependencies or restricted to licensing alone, and it covers more than just development or runtime dependencies. So the best description is that it understands and reviews dependency changes in pull requests, catching vulnerable or out-of-date dependencies.