We should also think about whether we really need dependency review as it caused failure/timeout very often. Maybe we should increase the timeout parameter for it?

Please open a PR to look into this. For some PRs, dependency review works flawlessly. For other PRs, dependency review times out, even after multiple restarts. The timeouts never seem to happen once the PRs are merged into master.

What is the point of dependency review on a PR at all? Is it to warn about adding a new high-risk dependency? Or is it only for future dependabot PRs?

Originally posted by @wmdietl in #1042 (comment)