CI should block a package update when it violates a defined security or sourcing policy—not merely because a scanner reports a finding. Start with reproducible installs and a reviewable diff of the complete dependency tree; fail on vulnerabilities at a risk-based threshold, disallowed packages or sources, and other explicit policy violations. Add provenance and package-health checks as evidence, not as proof of safety, and require documented, time-bounded exceptions.
What should a dependency-update gate check?
Treat each dependency update as a proposed change to the software supply chain. A useful gate combines controls that address different failure modes: a lockfile helps keep resolution reproducible; vulnerability scanning identifies known issues; source and package rules constrain what may be introduced; and review surfaces changes that automated checks cannot judge reliably.
GitHub’s dependency graph includes direct and transitive dependencies, and its dependency review feature presents dependency changes in pull requests. The review should therefore cover the resolved tree, not just the edited manifest line. Look for additions, removals, version changes, known vulnerabilities, and package-health signals such as release history, maintenance activity, security contacts, and lifecycle scripts.
| Control | What it helps detect or enforce | Important limitation |
|---|---|---|
| Lockfile and integrity verification | Unexpected resolution changes or content that does not match recorded integrity data | A reproducibly installed package can still be vulnerable or malicious. |
| Vulnerability audit or SBOM scan | Known vulnerabilities in resolved components, including transitive dependencies when covered by the tool | Results depend on the scanner’s ecosystem coverage and vulnerability data; a finding still needs a disposition policy. |
| Dependency diff review | New, removed, or changed packages and relevant context for reviewers | Review does not replace automated checks or guarantee that malicious behavior will be recognized. |
| Source allowlist and deny lists | Packages from unintended registries or explicitly prohibited package names or namespaces | An approved registry can still host a compromised or malicious release. |
| Provenance verification | Evidence about a package’s source and build process, and some changes in that evidence | It does not establish that the code is benign or that the selected package is the intended one. |
| Install-script review or restriction | Unexpected commands in pre-install or post-install behavior | Disabling scripts can break package functionality and requires compatibility testing. |
How should CI enforce vulnerability findings?
Choose and document a severity threshold that reflects the affected environment and the team’s tolerance for risk. A threshold is a policy decision, not a universal safe/unsafe boundary. ENISA’s 2026 Technical Advisory for Secure Use of Package Managers, version 1.1, published in March 2026, recommends enforcing security policies in CI/CD so builds do not proceed with known vulnerable components. It gives these concrete examples:
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minute#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
npm audit --omit=dev --audit-level=highfor an npm audit that omits development dependencies and sets a high-severity threshold.grype sbom:./sbom.json --fail-on Highto fail a Grype SBOM scan at the high threshold.
These are examples, not universal settings. Decide separately how CI treats development dependencies, vulnerabilities in code believed to be unreachable, findings with no available fix, and accepted risk. GitHub’s npm audit documentation describes severity-based CI failure and notes that some cases need manual intervention.
Make the check’s outcome unambiguous. A hard failure should prevent the normal merge path unless an authorized exception is recorded. A warning-only result is not a blocking control: GitHub’s dependency review action documents a warn-only option that reports vulnerabilities but lets the action succeed. Use that behavior only when another required step guarantees review and disposition.
How can CI make package resolution reproducible?
Commit the package manager’s lockfile and configure CI to install from it rather than silently resolving version ranges anew. Where supported, verify package integrity hashes as part of installation. ENISA recommends lockfile or hash verification and version pinning, but also cautions that pinning needs regular review and updates: a fixed version can preserve a known vulnerability just as reliably as it preserves a good resolution.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Reproducibility answers whether the build used the expected dependency resolution; it does not answer whether that resolution is safe. Pair it with vulnerability, source-trust, and review controls.
What should reviewers see in a dependency update?
Make the pull request show the dependency changes and enough context to assess them. Include direct and transitive changes where the platform supports them, plus vulnerability findings, release timing, and relevant maintenance or package-health signals. Investigate unnecessary or excessive components, unexpected lifecycle scripts, and changes that do not fit the application’s needs.
For GitHub repositories, dependency review can surface dependency changes in pull requests. The action’s documentation describes package and namespace deny lists and a severity-based failure setting. Its access and runtime requirements are version-sensitive: the documentation reviewed on October 7, 2026, says the action is available for public repositories and organization-owned private repositories with a GitHub Advanced Security license; it also says version 5 uses Node 24 and requires Actions Runner 2.327.1 or later. Check current GitHub documentation and repository eligibility before adopting it.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
How should CI control package sources and install scripts?
Restrict package sources
Configure the package manager or organization policy to use intended registries, and validate source URLs where feasible. A curated internal registry may fit organizations that need tighter control over approved packages. Treat this as a source-substitution control, not a vulnerability check: an allowed registry can still distribute a harmful release.
Review installation behavior
Inspect pre-install and post-install scripts for unexpected commands or behavior. In high-security or isolated environments, restricting or disabling install scripts can reduce attack surface, but it may also break packages that depend on them. Test compatibility and maintain a narrow exception process rather than applying the restriction blindly.
What do provenance and release delays add?
Use provenance as evidence, not a verdict
Where the ecosystem provides verifiable provenance, check whether a package maps to the expected source and build process, and pay attention to meaningful changes between versions. npm describes provenance statements as evidence of where and how a package was built, while explicitly warning that provenance does not guarantee the absence of malicious code. SLSA likewise explains that provenance verification does not solve package selection problems such as typosquatting. Retain identity checks, dependency review, and vulnerability scanning alongside provenance.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Consider a release cooldown
GitHub reports that Dependabot version updates wait until a release has been available for at least three days before opening an update pull request. That interval gives detection signals time to emerge before a downstream project proposes the release; it is not a guarantee of safety or a quantified reduction in attacks. If using other update tooling, verify its actual cooldown configuration rather than assuming the same behavior.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How should exceptions work?
An exception should be an auditable decision, not a way to turn a failing gate into an invisible warning. Require a named reviewer, a reason tied to the specific finding or policy, and an expiry date or scheduled follow-up review. Record what CI allowed and why, then reassess when a fix becomes available, the exposure changes, or the exception reaches its review date.
Keep exceptions narrow: scope them to the affected dependency and finding where possible rather than disabling the entire scanner or policy. If a tool cannot express a narrow exception, use a separate approval step that preserves the original finding and records the decision.
Free tools Windows power users keep installed
One-click scans. No signup required.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
How should teams choose and roll out controls?
Compare controls on what they detect, how much of the dependency tree and build-time environment they cover, whether they fail or merely warn, ecosystem support and data freshness, compatibility and false-positive costs, exception auditability, and the privileges required by the CI workflow. No single score or check covers all these dimensions.
- Establish a reliable baseline. Commit lockfiles, install from them in CI, and enable integrity verification where supported.
- Set blocking policy. Choose the vulnerability threshold and define treatment of development dependencies, reachability, missing fixes, denied packages, and prohibited sources.
- Review the full change. Surface direct and transitive dependency changes and relevant security and package-health context in the pull request.
- Add complementary evidence. Use an SBOM scan where it fits the build, plus source checks, script review, and provenance verification where available.
- Test outcomes before relying on them. Confirm that a violation actually fails the required CI check and that warnings cannot silently satisfy merge requirements.
- Operate the policy. Assign exception reviewers, record reasons and expiry or follow-up dates, and revisit thresholds as exposure and package-manager capabilities change.
How do you keep the CI gate from becoming a supply-chain weakness?
The workflow that evaluates packages must itself be protected. GitHub warns that combining privileged triggers such as pull_request_target or workflow_run with untrusted pull-request code or an untrusted checkout can expose secrets and repository write access. Avoid those combinations unless privileged context is necessary and carefully isolated.
For GitHub Actions, pin third-party actions to verified full-length commit SHAs when immutable use is required; GitHub identifies a full-length SHA as the way to use an action immutably. A movable version tag is not the same guarantee. Keep credentials, write permissions, and trusted workflow logic separated from code supplied by untrusted contributors.
