Dependency security: keeping web application packages safe

Your application includes other people’s code

Frameworks, plugins and libraries help teams ship faster, but they need maintenance. Dependencies can also pull in other packages. Build tooling deserves attention too: a vulnerability can affect development or deployment even when the package is not part of the browser bundle.

Know what is installed

Keep a reproducible lockfile and inventory the versions that actually ship. Compare the installed dependency tree with security advisories rather than relying only on the top-level package list. Consider whether the affected code is reachable in your deployment without dismissing a finding solely because it is indirect.

Apply a supported fix

Prefer a compatible parent-package update that brings in the patched dependency. Where that is not available, assess temporary mitigations and record the remaining exposure.

• Check patched versions and release notes
• Remove unused or unsupported packages
• Review major-version changes before applying them
• Avoid assuming the newest version is automatically compatible
• Track unresolved advisories with an owner

Verify the update

Run relevant tests and confirm that the installed tree contains the fixed version. Exercise critical journeys such as sign-in, uploads and privileged actions. A clean dependency report does not establish that business logic and permissions are secure.

Make patching an ongoing process

Set a review cadence and a route for urgent advisories. Keep development, staging and production aligned, and know how to roll back safely. Dependency checks complement penetration testing; neither replaces the other.