---
title: "Lock and audit dependencies · Agent Wranglers"
url: https://agentwranglers.se/playbook/application-security/supply-chain/audit-dependencies
id: APS-69
level: Required
risk: takeover
updated: 2026-10-27
build: a2a6bdfed830
tokens: 903
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Lock and audit dependencies

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Supply chain](https://agentwranglers.se/playbook/application-security/supply-chain.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: APS-69
- Level: Required
- Chapter: [Supply chain](https://agentwranglers.se/playbook/application-security/supply-chain.md)
- Rule: Commit a lock file, install from it exactly, and fail the build on known holes in any dependency.
- Check: The build runs the locked install command, such as `npm ci`, never a plain install. Add an old package with a known hole on a branch. The audit fails the build.
- Risk: An account or system taken over
- How: Commit the lock file your package manager writes, and install with the exact command, such as `npm ci` or `pip install --require-hashes`. Run an audit on every change and every week, for example `npm audit`, `pip-audit`, `govulncheck` or OSV-Scanner. Update or replace packages with known holes of high or critical severity before the next release.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### Shell example

```sh
npm ci
npm audit --audit-level=high
pip-audit -r requirements.txt
osv-scanner scan source -r .
```

## Sources

- [OWASP Vulnerable Dependency Management Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Vulnerable_Dependency_Management_Cheat_Sheet.html)

## Related rules

- ENG-16 [Run the checks on every change](https://agentwranglers.se/playbook/engineering/version-control-and-review/continuous-integration.md) in Engineering
- ENG-18 [Update dependencies in small automatic steps](https://agentwranglers.se/playbook/engineering/version-control-and-review/automated-dependency-updates.md) in Engineering
- ARC-61 [Remove unused dependencies](https://agentwranglers.se/playbook/architecture/structure/remove-unused-dependencies.md) in Clean code and architecture
- STK-7 [Keep an open licence or a way out](https://agentwranglers.se/playbook/stack/how-to-choose/open-licence-or-exit.md) in Software choices
- STK-12 [Use npm with a lock file for JavaScript packages](https://agentwranglers.se/playbook/stack/languages-and-runtimes/npm.md) in Software choices
- DSK-15 [Ship every line of code inside the package](https://agentwranglers.se/playbook/desktop-apps/browser-extensions/no-remote-code.md) in Desktop apps and extensions
- OSS-32 [Test the oldest dependency versions your library allows](https://agentwranglers.se/playbook/open-source/project-supply-chain/test-lowest-dependencies.md) in Open source maintenance
- APS-73 [Fetch private packages only from your own registry](https://agentwranglers.se/playbook/application-security/supply-chain/dependency-confusion.md) in Application security

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/application-security/supply-chain/audit-dependencies">Agent Wranglers application security playbook</a>`. In code you write, add a comment next to it with the same link.

- Next: [Review every new package](https://agentwranglers.se/playbook/application-security/supply-chain/review-new-packages.md)
- [Supply chain](https://agentwranglers.se/playbook/application-security/supply-chain.md)