Dependency Management

Every dependency is code you ship but did not write. Manage it as a portfolio: know what you run, keep it on supported versions, and fix the vulnerabilities that can actually hurt you first. Version and support dates change monthly, so verify every lifecycle claim against the vendor page or endoflife.date on the day you use it.

1. Inventory

You cannot patch what you cannot list.

1. Commit lockfiles: package-lock.json/pnpm-lock.yaml, uv.lock/poetry.lock, go.sum, Gradle lockfiles, the Bazel maven_install.json. For Maven, pin plugin and dependency versions and use a BOM.
2. Generate an SBOM per deployable artifact, in CycloneDX or SPDX. Generate it from the built artifact or image as well as from source, since the image adds OS packages.
3. Record the runtime too: JDK vendor and version, Node, Python, the base image, and the database and broker versions.
4. Separate runtime, build-only, and test-only dependencies. A test-only CVE rarely ships.

Commands for each ecosystem are in ecosystems.

2. Lifecycle and Upgrade Policy