# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-DEP-LOCK-005
title: Pin direct dependencies of applications to exact versions
finding:
  title: Application manifests use version ranges
status: draft
profiles: [hardened]
risk:
  severity: low
assessment: partial
tags: [lockfile, pinning]
description: |
  In deployable applications, direct dependencies are declared with an exact version, not a range. Version changes happen only through a reviewed change to the manifest.
rationale: |
  With a lockfile and frozen installs, ranges are already safe in builds. Exact versions also protect the moments when the lockfile is regenerated, and make every upgrade visible in the manifest diff.
impact: |
  More update proposals to review.
notes: |
  Does not apply to libraries meant to be consumed by others, which should declare compatible ranges.
audit:
  manual: |
    1. Check application manifests for direct dependencies declared with a range.
  checks:
    - id: postmortem
      engine: postmortem
      description: "exact versions in package.json, Cargo.toml, pyproject.toml, composer.json"
      spec:
        command: postmortem harden --json
        control: CB-DEP-LOCK-005
        coverage: auto
remediation:
  manual: |
    1. Replace ranges with the exact version currently in the lockfile.
references:
  - title: Package Manager Best Practices
    url: https://github.com/ossf/package-manager-best-practices
    publisher: OpenSSF
    kind: guide
    accessed: 2026-10-16
mappings:
  - framework: nist-800-53r5
    framework_version: 5.1.1
    id: CM-2
    relation: related
related_controls:
  - id: CB-DEP-LOCK-001
    type: related
  - id: CB-DEP-UPD-001
    type: related
authors:
  - name: Alice
    github: Sn0wAlice
introduced_in: 1.0.0
created: 2026-10-16
updated: 2026-10-16