Keep dependencies and runtimes current

Depend on fewer things, pin what you depend on, and patch your runtimes, web servers, and base images on a schedule.

Anchor to WhyWhy

A supply-chain attack arrives through something you depend on: a compromised package, a GitHub Action, a hosted CDN script, or a managed service. Unpatched runtimes, web servers, and self-hosted tools are a second path. Both are easier to manage with fewer dependencies and routine updates.

Anchor to HowHow

Anchor to Packages and build toolingPackages and build tooling

• Depend on fewer things. Every external dependency can change the code you ship.
• Commit lockfiles, enforce them in CI with a frozen-install flag, and pin GitHub Actions to a full commit SHA.
• Wait until a new package version is at least seven days old before you adopt it. Malicious releases are usually caught and pulled within days. Automate updates with a tool such as Dependabot or Renovate, set to the same waiting period.
• Upgrade a dependency with a known vulnerability promptly, even if your code doesn't call the vulnerable function. Another dependency might.
• Review a change of maintainer, a rename, a newly added install script, or a jump in transitive dependencies before you upgrade.
• If a coding assistant suggests a package, then confirm that it exists and is the one you meant before you install it. Attackers register package names that models commonly invent.
• Require multi-factor authentication on every package registry and source control account, and use scoped, short-lived publishing tokens.

Anchor to Runtimes and imagesRuntimes and images

• Follow the security advisories for your language runtime, framework, web server, and any self-hosted tools such as source control or CI. Apply critical fixes within days.
• Stay on supported versions. End-of-life versions get no fixes.
• Rebuild container base images on a schedule, not only your application layer, so that system packages and certificate authority bundles stay current.
• Keep your GraphQL Admin API version supported.

Anchor to Scripts loaded from a CDNScripts loaded from a CDN

Pin an exact version and use Subresource Integrity, so the browser rejects the file if its contents change: