conwy.co

It's best practice to keep an eye on dependency updates, especially where security fixes are needed. This can help us to avoid software supply chain vulnerabilities, which often feature in the OWASP Top 10.

Many organisations use an automated pipeline tool, such as Dependabot, to continuously scan for updates and generate pull requests into repos.

I recommend following a consistent process around reviewing and merging these generated pull requests. Especially in continuously deployed or mission-critical applications, we don't want to just merge anything and everything. If an upgrade explicitly addresses a known vulnerability, we should prioritise it. At the same time, we should perform appropriate tests to ensure the upgrade doesn't cause breakage generally.

To address the above, I came up with a checklist around dependency updates.

Dependency updates checklist#

Here is the link to the checklist:

👉

Dependency updates ChecklistFollow these checks when making updates to keep your application secure with minimal disruption.

Further reading#

• Blog: Hardening npm dependency security • Alex O'CALLAGHAN