---
title: "Lock and audit dependencies · Agent Wranglers"
url: https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/audit-dependencies
updated: 2026-10-20
licence: "All rights reserved"
---

# Lock and audit dependencies

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Supply chain and setup](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup)
- Rule: Commit a lock file, install from it exactly, and fail the build on known holes in any dependency.
- How: Commit the lock file your package manager writes, and install with the exact command, such as `npm ci` or `pip install --require-hashes`. Run an audit on every change and every week, for example `npm audit`, `pip-audit`, `govulncheck` or OSV-Scanner. Update or replace packages with known holes of high or critical severity before the next release.
- Check: The build runs the locked install command, such as `npm ci`, never a plain install. Add an old package with a known hole on a branch. The audit fails the build.

Example:

```sh
npm ci
npm audit --audit-level=high
pip-audit -r requirements.txt
osv-scanner scan source -r .
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/audit-dependencies`.

- Next: [Review every new package](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/review-new-packages)
- [Supply chain and setup](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup)