# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-DEP-UPD-001
title: Propose dependency updates automatically
finding:
  title: Dependencies are only updated by hand, when someone remembers
status: draft
profiles: [baseline]
risk:
  severity: medium
assessment: partial
tags: [updates, automation]
description: |
  An automated process opens change requests for new dependency versions, at least for security fixes and preferably for all updates. Proposals respect the release-age rule (CB-DEP-AGE-001) and run the full test suite.
rationale: |
  Small, frequent updates are easy to review and to roll back. Rare, large ones are risky, so teams avoid them, and fall behind until a vulnerability forces a painful jump.
impact: |
  A steady flow of change requests to review. Grouping related updates keeps it manageable.
audit:
  manual: |
    1. Check that automated update proposals are enabled for each project and ecosystem.
    2. Check that they wait for the release-age threshold.
  checks:
    - id: postmortem
      engine: postmortem
      description: "Dependabot / Renovate covers each ecosystem, with a cooldown ≥ the release age"
      spec:
        command: postmortem harden --json
        control: CB-DEP-UPD-001
        coverage: auto
remediation:
  manual: |
    1. Enable automated update proposals for every project and ecosystem.
    2. Configure the same minimum release age as CB-DEP-AGE-001.
references:
  - title: NIST SP 800-218 - Secure Software Development Framework (SSDF) 1.1
    url: https://csrc.nist.gov/pubs/sp/800/218/final
    publisher: NIST
    kind: standard
    accessed: 2026-10-16
  - title: Secure Supply Chain Consumption Framework (S2C2F)
    url: https://github.com/ossf/s2c2f
    publisher: OpenSSF
    kind: guide
    accessed: 2026-10-16
mappings:
  - framework: nist-800-53r5
    framework_version: 5.1.1
    id: SI-2
    relation: related
related_controls:
  - id: CB-DEP-AGE-001
    type: related
  - id: CB-DEP-UPD-002
    type: related
authors:
  - name: Alice
    github: Sn0wAlice
introduced_in: 1.0.0
created: 2026-10-16
updated: 2026-10-16