Pin direct dependencies of applications to exact versions

Description

In deployable applications, direct dependencies are declared with an exact version, not a range. Version changes happen only through a reviewed change to the manifest.

Does not apply to libraries meant to be consumed by others, which should declare compatible ranges.

Rationale

With a lockfile and frozen installs, ranges are already safe in builds. Exact versions also protect the moments when the lockfile is regenerated, and make every upgrade visible in the manifest diff.

Impact

More update proposals to review.

Audit

1. Check application manifests for direct dependencies declared with a range.

Automated: every check must pass. Scanners report each check by its id.

postmortem

exact versions in package.json, Cargo.toml, pyproject.toml, composer.json

command: postmortem harden --json
control: CB-DEP-LOCK-005
coverage: auto

Remediation

1. Replace ranges with the exact version currently in the lockfile.

References

• Package Manager Best Practices OpenSSF, guide, accessed 2026-10-16

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Related controls

• related CB-DEP-LOCK-001 Commit a lockfile for every deployable application
• related CB-DEP-UPD-001 Propose dependency updates automatically

People and lifecycle