Dependency Security
Dependency security manages the risk introduced by third-party libraries and packages in a software project. It covers vulnerability scanning, license compliance, update strategies, lock files, and supply-chain verification to prevent compromised or outdated dependencies from reaching production.
itSoftware supply chain security | OpenSkills.info
Course pathWalk it in order
Look it upDip in anytime
Go furtherLeaves this page
Don't Panic
Don't Panic: Dependency Security
Dependency security is the job of controlling the risk in code your application did not write. Packages save work. They are also rather enthusiastic about arriving with friends, relatives, and transitive dependencies who were not mentioned in the invitation. The result is a dependency graph: direct dependencies named in a manifest, and the dependencies they bring along.
A manifest says what a project asks for. A lockfile records one resolved graph, so installation can be repeated. An SBOM, a machine-processable component inventory, helps identify what a released product contains. None proves a component is safe. They make different questions answerable, which is less dramatic but much more useful.
A scan asks whether a package identity and version match a known advisory. That is detection, not a verdict. CVSS Base describes general technical severity, while the decision also needs exploit evidence, reachable behavior, exposure, privileges, data sensitivity, and the actual deployment. A high number without context is an alarm bell, not a complete evacuation plan.
The surprising part is that the work starts before installation and continues after release. Review the full graph change, not only the top-level version. Test updates, rescan the artifact that will ship, and monitor for new advisories or exploitation evidence. When a fix cannot happen now, an exception needs an owner, compensating control, and expiration date. Otherwise it is an ignored alert wearing office clothes.
Read the Intro for the graph-inside-a-loop model and vocabulary. Use Slides for control flow and artifact distinctions. Keep the Cheatsheet nearby for triage signals, update review, and exception records. The Practice reference turns those ideas into a review routine, while the Exercise asks you to make one dependency decision visible enough for another person to check.
Where this skill leads
Relevant careers
See how this topic contributes to broader role-level skill maps.
Sources
- https://owasp.org/Top10/2025/A03_2025-Software_Supply_Chain_Failures/
Supports
- Software supply chain failures include vulnerable or malicious third-party code, tools, and dependencies
- Direct and nested dependency versions require tracking
- Unsupported, outdated, and unmaintained components create risk
- Regular vulnerability monitoring, trusted sources, change tracking, testing, and risk-based updates
- https://csrc.nist.gov/pubs/sp/800/218/final
Supports
- Secure development practices integrated across the software development life cycle
- Acquisition and maintenance of well-secured third-party components
- Component evaluation in the context of expected use
- Ongoing vulnerability identification, assessment, remediation, and root-cause response
- https://docs.github.com/en/code-security/concepts/supply-chain-security/dependency-review
Supports
- Pull-request review of dependency changes in manifests and lockfiles
- Direct updates can also change transitive dependencies
- Detection and prevention of newly introduced known-vulnerable versions
- https://google.github.io/osv.dev/api/
Supports
- Vulnerability queries by package ecosystem, name, version, or commit
- Single, batch, and identifier-based query operations
- https://www.first.org/cvss/v4.0/implementation-guide
Supports
- CVSS Base as system-independent severity rather than complete organizational risk
- Threat metrics for exploit maturity
- Environmental metrics for local impact, asset criticality, and validated mitigations
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Supports
- Catalog entries based on evidence of exploitation in the wild
- KEV as an input to vulnerability-management prioritization
- https://www.cisa.gov/sites/default/files/2025-08/2025_CISA_SBOM_Minimum_Elements.pdf
Supports
- SBOM as machine-processable component information
- Hierarchical components, subcomponents, and dependency relationships
- Component identity and inventory for transparency and tracking
- https://docs.npmjs.com/cli/v11/configuring-npm/package-lock-json/
Supports
- package-lock.json records the exact generated dependency tree
- Subsequent installs can reproduce the tree despite intermediate dependency updates
- The lockfile is intended for source control
- https://pip.pypa.io/en/stable/topics/secure-installs/
Supports
- Hash-checking mode with local hashes protects against remote tampering and network issues
- Hash-checking requires all dependencies to be specified, hashed, and pinned
- Package integrity checks are distinct from vulnerability analysis
- https://google.github.io/osv-scanner/usage/
Supports
- OSV-Scanner extracts package information before matching it against vulnerability databases
- OSV-Scanner can scan a project source tree and supported lockfiles
- https://docs.snyk.io/scan-with-snyk/snyk-open-source
Supports
- Snyk Open Source identifies vulnerabilities and license issues in open-source dependencies
- Snyk Open Source covers indirect dependencies and remediation workflows
- https://docs.mend.io/platform/latest/mend-sca
Supports
- Mend SCA supports dependency resolution, findings review, and reachability prioritization
- https://docs.blackduck.com/r/blackduck/latest/black-duck-documentation/getting-started-with-black-duck-sca.html
Supports
- Black Duck SCA identifies third-party components and supports vulnerability and license risk assessment
- https://docs.github.com/en/code-security/concepts/supply-chain-security/dependency-graph
Supports
- GitHub dependency graph summarizes manifest and lockfile dependency data
- GitHub dependency review provides pull-request information about vulnerable dependencies
- https://blog.npmjs.org/post/161276872334/npm5-is-now-npmlatest.html
Supports
- npm version 5 made lockfiles the default in May 2017
- Lockfiles made npm installations reproducible
- https://nvd.nist.gov/vuln/detail/cve-2014-0160
Supports
- CVE-2014-0160 documented the Heartbleed vulnerability in affected OpenSSL TLS and DTLS implementations
- https://github.blog/changelog/2019-11-14-automated-updates/
Supports
- GitHub automated security updates became generally available for public repositories in November 2019
- https://github.blog/changelog/2020-06-23-keep-all-your-packages-up-to-date-with-dependabot/
Supports
- GitHub announced scheduled Dependabot version updates in June 2020
- https://www.govinfo.gov/content/pkg/CFR-2022-title3-vol1/pdf/CFR-2022-title3-vol1-eo14028.pdf
Supports
- Executive Order 14028 defined an SBOM as a formal record of component details and supply-chain relationships
- https://security.googleblog.com/2021/06/introducing-slsa-end-to-end-framework.html
Supports
- Google introduced SLSA as an end-to-end supply-chain integrity framework in June 2021
- https://www.openwall.com/lists/oss-security/2024/03/29/4
Supports
- An oss-security report described a backdoor in upstream xz releases and its potential effect on SSH server compromise