In the pull request, how can developers avoid adding new dependencies with known vulnerabilities?

To detect and block vulnerable dependencies before merge , developers should use the Dependency Review GitHub Action in their pull request workflows. It scans all proposed dependency changes and flags any packages with known vulnerabilities.

This is a preventative measure during development, unlike Dependabot, which reacts after the fact .