Selection: Security Criteria Before You Add a Dependency
The best time to address dependency risk is before a dependency is added. Mature programs apply selection criteria at contribution time: OpenSSF Scorecard score above a defined threshold; active maintenance with recent commits and responsive issue handling; no high/critical unpatched CVEs in the last 12 months; a license approved by your policy; an acceptable number of transitive dependencies introduced. Many teams implement these checks as a pre-commit or pre-PR process that runs automatically when new dependencies appear in manifests.
Pinning and Lock Files: The Foundation of Reproducibility
Exact version pinning in lock files (package-lock.json, Pipfile.lock, Cargo.lock, go.sum) is the foundation of reproducible, auditable builds. Without lock files, builds may silently pull newer versions of dependencies that introduce vulnerabilities or breaking changes. Lock files should be committed to version control and treated as security artifacts — changes to lock files (especially dependency additions) should be reviewed with the same scrutiny as source code changes. Hash-based integrity verification (--integrity fields in npm, hash verification in pip) should be enabled to prevent dependency substitution attacks.
Automated Updates: Balancing Currency with Risk
Keeping dependencies current reduces exposure to known vulnerabilities but introduces the risk of breaking changes and untested behavior. Tools like Dependabot, Renovate, and Mend Renovate automate dependency update PRs while allowing teams to configure update cadence, auto-merge rules for minor/patch updates, and test-gating before auto-merge. The key metric is mean time to update for security patches — this should be days, not months.
Lifecycle Monitoring: SBOM as the Continuous Audit
The SBOM generated from your lock file at each build is the foundation for continuous lifecycle monitoring. Cross-referencing the SBOM against vulnerability databases on every build, and alerting when new CVEs affect current components, creates an early warning system that catches new vulnerability disclosures as soon as they occur. Combined with end-of-life tracking (alerting when a dependency reaches vendor EOL), the SBOM-driven monitoring model provides complete lifecycle visibility.
SBOM-Driven Dependency Governance with Fossity
Fossity — Fossity integrates with your existing package managers and lock files to generate SBOMs on every build, enforce dependency selection policies, and continuously monitor your dependency portfolio against the latest vulnerability intelligence.
Visit Fossity.com →