dependency-review
Safeguard articles tagged "dependency-review" — guides, analysis, and best practices for software supply chain and application security.
6 articles
GitHub dependency graph and dependency review explained
How GitHub Dependency Graph and Dependency Review actually work, what GitHub Advanced Security adds on top, and where the coverage gaps are for teams relying on manifest-only scanning.
How to Set Up Dependency Review on GitHub Pull Requests
GitHub's dependency-review-action can block PRs that introduce vulnerable or badly-licensed packages. Here is the exact configuration, plus the cases it silently misses.
universal-cookie: Package Review and Cookie Security Basics
A review of the universal cookie npm package: what it does in isomorphic apps, the advisory it inherited through its cookie dependency, and the cookie security flags that matter more than the library.
broadcast-channel npm Package: Health, Security, and Alternatives
A practitioner review of the broadcast-channel npm package: maintenance health, how its storage fallbacks work, the security boundaries of cross-tab messaging, and when the native API is enough.
Rust Tokio Dependency Security Review
Tokio is the async runtime underneath most production Rust. A supply chain review of Tokio and the crates that orbit it — dependencies, CVE history, and what changes across versions.
How to Enable Dependency Review on GitHub PRs
A step-by-step tutorial for turning on GitHub Dependency Review, enforcing license and severity policies, and getting fast feedback on every pull request.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.