A gate for brand new dependencies
The sensible reply is to make dependency adjustments a separate, enforceable a part of code assessment. A pull request that provides a package deal or adjustments its resolved model ought to produce a dependency diff earlier than it could possibly merge. Identified-vulnerability checks stay helpful, however they’re just one enter: indexed-btree didn’t want a identified CVE to be harmful. The gate should additionally present the precise package deal identify, model, provenance when out there, and the revealed recordsdata that can really run.
For an present dependency receiving a routine replace, groups can apply their regular coverage. A brand new identify, a change to a look-alike package deal, a change of writer, or an unexplained executable or obfuscated file ought to pause the merge for an proprietor to analyze. That may be a determination rule, not a request for each engineer to learn each line of node_modules. Evaluation the resolved artifact and its change from the beforehand authorised model; file why the package deal is required and the place it’s going to execute.
Use an automatic dependency diff to make this seen on each pull request, then require the test in department safety. GitHub’s dependency assessment, for instance, can implement checks for newly launched identified vulnerabilities and present package deal adjustments. It doesn’t certify {that a} package deal with out an advisory is protected. Add a separate rule for brand new or surprising package deal identities and route these instances to a chosen reviewer. The merge final result must be specific: approve the precise model for an outlined use, examine it, or reject it.