--- title: Keep dependencies and runtimes current description: >- Depend on fewer things, pin what you depend on, and patch your runtimes, web servers, and base images on a schedule. source_url: html: >- https://shopify.dev/docs/apps/build/security/infrastructure-and-accounts/keep-dependencies-and-runtimes-current md: >- https://shopify.dev/docs/apps/build/security/infrastructure-and-accounts/keep-dependencies-and-runtimes-current.md --- # Keep dependencies and runtimes current Depend on fewer things, pin what you depend on, and patch your runtimes, web servers, and base images on a schedule. *** ## Why A supply-chain attack arrives through something you depend on: a compromised package, a GitHub Action, a hosted CDN script, or a managed service. Unpatched runtimes, web servers, and self-hosted tools are a second path. Both are easier to manage with fewer dependencies and routine updates. *** ## How ### Packages and build tooling * Depend on fewer things. Every external dependency can change the code you ship. * Commit lockfiles, enforce them in CI with a frozen-install flag, and pin GitHub Actions to a full commit SHA. * Wait until a new package version is at least seven days old before you adopt it. Malicious releases are usually caught and pulled within days. Automate updates with a tool such as Dependabot or Renovate, set to the same waiting period. * Upgrade a dependency with a known vulnerability promptly, even if your code doesn't call the vulnerable function. Another dependency might. * Review a change of maintainer, a rename, a newly added install script, or a jump in transitive dependencies before you upgrade. * If a coding assistant suggests a package, then confirm that it exists and is the one you meant before you install it. Attackers register package names that models commonly invent. * Require multi-factor authentication on every package registry and source control account, and use scoped, short-lived publishing tokens. ### Runtimes and images * Follow the security advisories for your language runtime, framework, web server, and any self-hosted tools such as source control or CI. Apply critical fixes within days. * Stay on supported versions. End-of-life versions get no fixes. * Rebuild container base images on a schedule, not only your application layer, so that system packages and certificate authority bundles stay current. * Keep your GraphQL Admin API version [supported](https://shopify.dev/docs/api/usage/versioning). ### Scripts loaded from a CDN Pin an exact version and use Subresource Integrity, so the browser rejects the file if its contents change: ```html ``` ***