Agent WranglersAPS-69Required
Lock and audit dependencies
Commit a lock file, install from it exactly, and fail the build on known holes in any dependency.
How to do it
Commit the lock file your package manager writes, and install with the exact command, such as npm ci or pip install --require-hashes. Run an audit on every change and every week, for example npm audit, pip-audit, govulncheck or OSV-Scanner. Update or replace packages with known holes of high or critical severity before the next release.
Examples
Shell example
npm ci
npm audit --audit-level=high
pip-audit -r requirements.txt
osv-scanner scan source -r .How to check
The build runs the locked install command, such as npm ci, never a plain install. Add an old package with a known hole on a branch. The audit fails the build.
Sources
Related rules
- ENG-16 Run the checks on every change in Engineering
- ENG-18 Update dependencies in small automatic steps in Engineering
- ARC-61 Remove unused dependencies in Clean code and architecture
- STK-7 Keep an open licence or a way out in Software choices
- STK-12 Use npm with a lock file for JavaScript packages in Software choices
- DSK-15 Ship every line of code inside the package in Desktop apps and extensions
- OSS-32 Test the oldest dependency versions your library allows in Open source maintenance
- APS-73 Fetch private packages only from your own registry in Application security
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/application-security/supply-chain/audit-dependencies">Agent Wranglers application security playbook</a>. In code you write, add a comment next to it with the same link.