Automate your open-source dependency scanning with Advanced Security
Aug 4, 2025Laura Jiang

Summary
Introduces automated injection of the dependency scanning task into Azure Pipelines runs targeting the default branch. This task evaluates open-source dependencies for vulnerabilities. It also enables pull request annotations for dependency scanning findings and integrates with repository build validation policies. Configuration options include enabling 'Scan default branch for vulnerable dependencies' in repository settings or using environment variables like `DependencyScanning.Skip: true` or pipeline variables like `dependencyScanningInjectionEnabled` to control injection.
More from the Azure Pipelines Supply Chain Security trail
- Axios npm Supply Chain Compromise – Guidance for Azure Pipelines Customers
- One Pipeline to Rule Them All: Ensuring CodeQL Scanning Results and Dependency Scanning Results Go to the Intended Repository
- April Patches for Azure DevOps Server and Team Foundation Server
- Introducing Pull Request Annotation for CodeQL and Dependency Scanning in GitHub Advanced Security for Azure DevOps
- February patches for Azure DevOps Server