diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 43d34f3..dc890ab 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -48,3 +48,10 @@ jobs:
                   -Dsonar.issue.ignore.multicriteria.e2.resourceKey=**/docker/scripts/load-dummy-data.sh
                   -Dsonar.issue.ignore.multicriteria.e3.ruleKey=secrets:S2068
                   -Dsonar.issue.ignore.multicriteria.e3.resourceKey=**/docker/.env
+
+            - name: Dependency Review
+              if: github.event_name == 'pull_request'
+              uses: actions/dependency-review-action@v4
+              with:
+                fail-on-severity: moderate
+                comment-summary-in-pr: always
\ No newline at end of file
diff --git a/.npmrc b/.npmrc
new file mode 100644
index 0000000..97de5ae
--- /dev/null
+++ b/.npmrc
@@ -0,0 +1,3 @@
+save-exact=true
+ignore-scripts=true
+min-release-age=7