iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
To manage software dependencies, treat every package your application relies on as an ongoing operational commitment: keep builds repeatable, know where components come from, verify artifacts, monitor for fixes, and remove components you no longer need. That includes transitive dependencies—packages brought in by other packages—even when your own code never names them.
What is a software dependency, and why does the whole tree matter?
A dependency is software an application requires to function, such as a library or plugin. A direct dependency is one your application references. A transitive dependency is required by a direct dependency; it may itself bring in more packages. The result is a recursive dependency tree, not just the short list visible in application code. Google Cloud’s dependency guidance, last updated September 30, 2026, describes this distinction.
Every component in that tree can affect whether the application builds and behaves as expected, and whether it is exposed to a vulnerability. Dependency management therefore means accounting for the resolved tree, not only reviewing the packages developers deliberately added.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesHow do you make builds repeatable without falling behind?
Pin versions and use lockfiles for different jobs
A version pin constrains a dependency to a specific version or range. Pinning a single version helps keep builds consistent, but it also means later fixes and improvements will not arrive automatically. A lockfile records the resolved versions to install, including downstream dependencies where the ecosystem supports it. It makes repeated installations more consistent; it does not establish that those versions are safe, supported, or current.
#1 Best Overall
Pinning application-declared dependencies alone may not constrain the entire resolved tree. Use the package manager’s lockfile where available, commit it as appropriate for the project, and ensure automated builds install from the recorded resolution rather than silently selecting a different set of versions.
Make updates a recurring maintenance task
Pair reproducible builds with a deliberate update process. Automated dependency-management tools can monitor releases and propose changes to dependency files. Review and test those proposals, including changes to transitive packages, so a stable build does not become a permanently stale one. Update review should account for security fixes as well as bug fixes and compatibility changes.
How do you control package sources and verify artifacts?
Version repeatability and artifact authenticity are separate concerns. A lockfile can help preserve which versions are selected; source controls and integrity checks help address where those components came from and whether their contents changed.
Choose and separate package sources
Public repositories provide convenient access to packages, but components hosted there are outside an organization’s direct control. Google recommends private registries where possible to centralize dependencies and apply access controls. Vendoring—copying dependency contents into a project—can provide more control when a private registry is not feasible, but enlarges the repository and makes upgrades harder.
Mixing internal and public packages can create dependency-confusion risk: an installer may resolve an attacker-controlled public package that uses an internal package name. Mitigations described in Google’s guidance include separating sources, mirroring packages, setting repository-priority controls, and verifying lockfile resolutions.
Verify integrity with hashes or signatures
Comparing an artifact with a provider’s hash can reveal replacement, tampering, or corruption, but the check still depends on trusting the source of that hash. Signatures provide another verification mechanism when maintainers or repositories sign artifacts. These measures strengthen source and integrity assurance; they do not replace vulnerability monitoring or update review.
How should teams handle unused dependencies?
Remove components that the application no longer needs. Unused packages expand the dependency footprint and can expose software to vulnerabilities in code it does not use. Audit requirements against actual use during regular linting and testing, and avoid copying development-only dependencies into production requirements.
What an SBOM tells you—and what it does not
NIST defines a software bill of materials (SBOM), following Executive Order 14028, as a “formal record containing the details and supply chain relationships of various components used in building software.” Like an ingredients list, it helps a team see what went into software. NIST says SBOMs can improve transparency and provenance, and help teams identify and remediate vulnerabilities faster. They complement, rather than replace, vulnerability management and supplier-risk assessment.
Use machine-readable inventories
NIST’s guidance identifies SPDX, CycloneDX, and SWID as acceptable standard formats and recommends machine-readable SBOMs that support automated ingestion and monitoring. An inventory is most useful when teams can analyze it and connect its components to action, rather than treating it as a document created once and filed away.
Timing matters: an SBOM generated retroactively may not reproduce the exact dependency list used at build time. A build-time inventory is better positioned to represent those inputs. NIST’s SP 800-204D, finalized February 12, 2024, places supply-chain security measures within the software delivery pipeline.
Account for the 2026 update without treating it as universal law
In an announcement dated July 29, 2026, CISA said updated joint minimum elements refine SBOM fields, including component hashes, licenses, SBOM tool names, and generation context; improve component documentation and sharing practices; address open source, AI, and SaaS; and emphasize machine-processable formats. The announcement describes joint guidance from CISA, NSA, the FBI, and international partners—not a legal requirement that automatically applies to every team. See CISA’s announcement for its scope and details.
Where do dependency checks belong in the delivery process?
Make dependency inventory, artifact verification, vulnerability scanning, and update review routine parts of delivery rather than a one-time cleanup. NIST SP 800-204D describes CI/CD stages spanning build, test, package, and deploy, and outlines ways to integrate software supply-chain security measures into those pipelines.
- Build: resolve dependencies from controlled sources and preserve the resolved inputs.
- Test: check the dependency inventory and proposed updates, including transitive changes.
- Package: verify artifact integrity and produce a machine-readable inventory tied to the build.
- Deploy and maintain: use inventory and monitoring to identify affected components and act on fixes.
The controls answer different questions: pins and lockfiles support repeatability; registry and verification practices address source and integrity; SBOMs provide visibility; and ongoing vulnerability management turns that visibility into response.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
