Propose dependency updates automatically

Description

An automated process opens change requests for new dependency versions, at least for security fixes and preferably for all updates. Proposals respect the release-age rule (CB-DEP-AGE-001) and run the full test suite.

Rationale

Small, frequent updates are easy to review and to roll back. Rare, large ones are risky, so teams avoid them, and fall behind until a vulnerability forces a painful jump.

Impact

A steady flow of change requests to review. Grouping related updates keeps it manageable.

Audit

1. Check that automated update proposals are enabled for each project and ecosystem.
2. Check that they wait for the release-age threshold.

Automated: every check must pass. Scanners report each check by its id.

postmortem

Dependabot / Renovate covers each ecosystem, with a cooldown ≥ the release age

command: postmortem harden --json
control: CB-DEP-UPD-001
coverage: auto

Remediation

1. Enable automated update proposals for every project and ecosystem.
2. Configure the same minimum release age as CB-DEP-AGE-001.

References

• NIST SP 800-218 - Secure Software Development Framework (SSDF) 1.1 NIST, standard, accessed 2026-10-16
• Secure Supply Chain Consumption Framework (S2C2F) OpenSSF, guide, accessed 2026-10-16

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Related controls

• related CB-DEP-AGE-001 Wait a minimum age before installing a new package version
• related CB-DEP-UPD-002 Require human review for risky updates

People and lifecycle