Deprecate deny lists #958

claire153 · 2025-08-13T21:09:18Z

Closes https://github.com/github/dependency-graph/issues/6488.

Adds a deprecation warning in the following places:
- README
- Dependency Review action Summary, only if the deprecated option is being used: see in this test run:

- I also included small lint fixes.

README.md

Copilot

Pull Request Overview

This PR deprecates the deny-licenses configuration option by adding deprecation warnings and making minor lint improvements. The purpose is to guide users toward using the allow-licenses option instead as part of a planned phase-out of deny list functionality.

Adds a deprecation warning message to the action summary output
Updates README documentation to mark deny-licenses as deprecated
Includes small lint fixes in test files (variable declaration improvements and unused import removal)

Reviewed Changes

Copilot reviewed 3 out of 6 changed files in this pull request and generated 2 comments.

File	Description
src/summary.ts	Adds deprecation warning function and calls it in the main summary function
tests/summary.test.ts	Adds test for deprecation warning and includes lint fixes for variable declarations
README.md	Updates documentation to mark deny-licenses option as deprecated

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
You can also share your feedback on Copilot code review for a chance to win a $100 gift card. Take the survey.}

src/summary.ts

__tests__/summary.test.ts

dangoor

Looking good! Just a couple minor comments.

src/summary.ts

__tests__/summary.test.ts

ahpook · 2025-08-14T22:46:04Z

To follow up on my comments after thinking it over a bit more, two points:

I think it's better to word this as a possible deprecation for removal in a future release. We actually don't know how widespread the usage of the deny-licenses directive is, and it's possible that there are irreplacable use cases that we should take into consideration. So I'd suggest something like "This option is deprecated for possible removal in the next major release. See Deprecate the deny-licenses option #938 for more information." That way people can register feedback and it doesn't sound quite so didactic.
Related, please add an option to suppress deprecation messages - there may be more things we want to change as we're headed towards a 5.0 release, but getting a warning on every PR check will be super spammy and annoying.

…Update copy.

claire153 · 2025-08-15T18:17:46Z

Thanks for both reviews!

@ahpook
Regarding your second point about adding an option to suppress deprecation messages: the warning only appears in the summary as required by the task (see screenshot in this PR's description).
It does not appear in the output of the job (see screenshot below). I agree it would have been spammy in there.

Do you think we should also be somehow allowing users to suppress the message in the Summary?
If so, I can look into a way of doing it.

dangoor

I don't have a strong preference on the warning suppression, so I'll leave that to @ahpook. From my perspective, a little tweak to the tests and this looks good!

dangoor · 2025-08-15T20:03:02Z

__tests__/summary.test.ts

@@ -119,8 +119,25 @@ test('adds deprecation warning for deny-licenses option', () => {
  )
  const text = core.summary.stringify()

+  expect(text).not.toContain(
+    '⚠️ <strong>Deprecation Warning</strong>: The <em>deny-licenses</em> option is deprecated and will be removed in the next major version release, use <em>allow-licenses</em> instead.'


nit: For a not.toContain test, I'd check for something short like deny-licenses or Deprecation Warning because any little text change would make this test always pass and not tell us anything useful.

Actually, looks like this is already the case… the deprecation warning could be there, but the text of the warning is different from what we're testing for.

Corrected! Thank you for spotting this!

dangoor · 2025-08-15T20:04:59Z

__tests__/summary.test.ts

  expect(text).toContain(
-    '⚠️ <strong>Deprecation Warning</strong>: The <em>deny-licenses</em> option is deprecated and will be removed in a future version, use <em>allow-licenses</em> instead.'
+    '⚠️ <strong>Deprecation Warning</strong>: The <em>deny-licenses</em> option is deprecated for possible removal in the next major release. See [Deprecate the deny-licenses option #938](https://github.com/actions/dependency-review-action/issues/938) for more information.'


This one is more personal preference, but I would make this test resilient to change just like in the negative case. I'd rather not see this test have to change every time there's a minor text edit.

I like that as well

ahpook · 2025-08-15T20:22:11Z

Regarding your second point about adding an option to suppress deprecation messages: the warning only appears in the summary as required by the task (see screenshot in this PR's description).

Ah ok, nevermind me then. I'd thought it was inline in the PR.

ahpook

Nice, i like it!

…2 [skip ci] Bumps [actions/dependency-review-action](https://github.com/actions/dependency-review-action) from 4.7.1 to 4.7.2. Release notes *Sourced from [actions/dependency-review-action's releases](https://github.com/actions/dependency-review-action/releases).* > 4.7.2 > ----- > > What's Changed > -------------- > > * Add Missing Languages to CodeQL Advanced Configuration by [`@KyFaSt`](https://github.com/KyFaSt) in [actions/dependency-review-action#945](https://redirect.github.com/actions/dependency-review-action/pull/945) > * Deprecate deny lists by [`@claire153`](https://github.com/claire153) in [actions/dependency-review-action#958](https://redirect.github.com/actions/dependency-review-action/pull/958) > * Address discrepancy between docs and reality by [`@ahpook`](https://github.com/ahpook) in [actions/dependency-review-action#960](https://redirect.github.com/actions/dependency-review-action/pull/960) > > New Contributors > ---------------- > > * [`@KyFaSt`](https://github.com/KyFaSt) made their first contribution in [actions/dependency-review-action#945](https://redirect.github.com/actions/dependency-review-action/pull/945) > * [`@claire153`](https://github.com/claire153) made their first contribution in [actions/dependency-review-action#958](https://redirect.github.com/actions/dependency-review-action/pull/958) > * [`@ahpook`](https://github.com/ahpook) made their first contribution in [actions/dependency-review-action#960](https://redirect.github.com/actions/dependency-review-action/pull/960) > > **Full Changelog**: <actions/dependency-review-action@v4...v4.7.2> Commits * [`bc41886`](actions/dependency-review-action@bc41886) Cut 4.7.2 version release ([#964](https://redirect.github.com/actions/dependency-review-action/issues/964)) * [`1c73553`](actions/dependency-review-action@1c73553) Merge pull request [#960](https://redirect.github.com/actions/dependency-review-action/issues/960) from ahpook/ahpook/address-docs-dashes * [`fac3d41`](actions/dependency-review-action@fac3d41) Bump the minor-updates group across 1 directory with 5 updates ([#956](https://redirect.github.com/actions/dependency-review-action/issues/956)) * [`d8073c4`](actions/dependency-review-action@d8073c4) Merge pull request [#958](https://redirect.github.com/actions/dependency-review-action/issues/958) from actions/claire153/deprecate-deny-lists * [`77184c6`](actions/dependency-review-action@77184c6) Fix tests * [`5558c35`](actions/dependency-review-action@5558c35) Address discrepancy between docs and reality * [`e85d57a`](actions/dependency-review-action@e85d57a) Remove test code * [`3eb6279`](actions/dependency-review-action@3eb6279) Re-add test package. Only show warning in summary if option is used. Update c... * [`7cf33ac`](actions/dependency-review-action@7cf33ac) Remove test deny list * [`493bee0`](actions/dependency-review-action@493bee0) Remove test package * Additional commits viewable in [compare view](actions/dependency-review-action@da24556...bc41886) [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility\_score?dependency-name=actions/dependency-review-action&package-manager=github\_actions&previous-version=4.7.1&new-version=4.7.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- Dependabot commands and options You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

claire153 added 11 commits August 13, 2025 21:07

Test deny list

70e1d26

Add new package

9ca24b6

Add deprecation warning, fix lint issues

6e2bbef

Build

c1fa9df

Add one more line break

a92a9da

Add one more line break

7d16ba5

Add one more line break

3fb5c61

Add one more line break

6e80be3

Update copy and styling

659a1e1

Remove test package

493bee0

Remove test deny list

7cf33ac

claire153 commented Aug 14, 2025

View reviewed changes

README.md Outdated Show resolved Hide resolved

claire153 marked this pull request as ready for review August 14, 2025 18:03

Copilot AI review requested due to automatic review settings August 14, 2025 18:03

claire153 requested a review from a team as a code owner August 14, 2025 18:03

Copilot AI reviewed Aug 14, 2025

View reviewed changes

src/summary.ts Outdated Show resolved Hide resolved

__tests__/summary.test.ts Show resolved Hide resolved

dangoor reviewed Aug 14, 2025

View reviewed changes

src/summary.ts Outdated Show resolved Hide resolved

src/summary.ts Outdated Show resolved Hide resolved

ahpook reviewed Aug 14, 2025

View reviewed changes

__tests__/summary.test.ts Outdated Show resolved Hide resolved

claire153 added 2 commits August 15, 2025 15:49

Re-add test package. Only show warning in summary if option is used. …

3eb6279

…Update copy.

Remove test code

e85d57a

dangoor reviewed Aug 15, 2025

View reviewed changes

ahpook previously approved these changes Aug 16, 2025

View reviewed changes

Fix tests

77184c6

claire153 dismissed ahpook’s stale review via 77184c6 August 18, 2025 15:10

claire153 requested a review from dangoor August 18, 2025 15:12

dangoor approved these changes Aug 18, 2025

View reviewed changes

claire153 merged commit d8073c4 into main Aug 18, 2025
7 checks passed

claire153 deleted the claire153/deprecate-deny-lists branch August 18, 2025 16:33

ahpook mentioned this pull request Aug 26, 2025

[BUG] Don't include the full URL to the issue in the deprecation warning #973

Closed

Deprecate deny lists #958

Deprecate deny lists #958

Uh oh!

Conversation

claire153 commented Aug 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Uh oh!

dangoor left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ahpook commented Aug 14, 2025

Uh oh!

claire153 commented Aug 15, 2025

Uh oh!

dangoor left a comment

Choose a reason for hiding this comment

Uh oh!

dangoor Aug 15, 2025

Choose a reason for hiding this comment

Uh oh!

dangoor Aug 15, 2025

Choose a reason for hiding this comment

Uh oh!

claire153 Aug 18, 2025

Choose a reason for hiding this comment

Uh oh!

dangoor Aug 15, 2025

Choose a reason for hiding this comment

Uh oh!

claire153 Aug 18, 2025

Choose a reason for hiding this comment

Uh oh!

ahpook commented Aug 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ahpook left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

claire153 commented Aug 13, 2025 •

edited

Loading

ahpook commented Aug 15, 2025 •

edited

Loading