Dependency Management

You inherit your dependencies' risks

Modern software leans heavily on third-party libraries, which is sensible — but every dependency you pull in becomes part of your system's behaviour and its attack surface. A bug or vulnerability in a library you use is, in effect, a bug in your application. Managing dependencies is therefore not housekeeping; it is part of keeping your service secure and reliable.

This includes transitive dependencies: the libraries your libraries depend on, which you never chose directly but still ship. A realistic view of your supply chain counts these too, because a weakness deep in the tree affects you just as surely as one you imported by name.

Pin for reproducibility

Builds should be reproducible: the same source should produce the same result today and next year. Pinning exact versions, recorded in a lock file, achieves this by ensuring everyone — and every environment — installs precisely the same dependency versions rather than whatever is newest at build time.

# lock file records exact, resolved versions
http-client == 4.2.1
json-parser == 2.0.7   # transitive, pinned too

Without pinning, an unannounced upstream release can change your behaviour silently between two builds of identical code — a maddening class of bug to chase. Commit the lock file so the whole team shares one resolved set.

Update deliberately

Pinning must not become neglect. Outdated dependencies accumulate known vulnerabilities and drift ever further from current versions, making the eventual upgrade harder. Update on a regular cadence, in small steps, so each change is easy to test and to roll back — a steady stream of minor updates is far less risky than one giant leap after years of standing still.

Lean on automated tooling that proposes dependency updates and runs them through your tests. The combination of frequent, small, tested upgrades keeps you current without the fear that any single update will quietly break production.

Watch the supply chain

New vulnerabilities are disclosed in popular libraries all the time, so you need a way to learn when one affects you. Automated vulnerability scanning compares your dependency tree, transitive packages included, against databases of known issues and flags anything that needs attention, turning a manual chore into a continuous check.

Have a plan for acting on what it finds: a process to assess severity and apply or schedule a fix promptly. Pair this with basic API security practices, since a vulnerable dependency is one of the most common ways an otherwise sound application is compromised.