Require human review for risky updates

Description

Updates are never merged without human review when they are a new major version, when the package changed maintainers or publisher, or when the new version adds install-time scripts or new dependencies. Automatic merging, if used, is limited to minor and patch updates that pass tests, and is not used in the hardened profile.

Rationale

Account takeovers and hostile maintainer changes show up as an ordinary new version. These signals are the ones that most often precede a malicious release.

Impact

More manual reviews.

Audit

1. Review automatic merge rules.
2. Check that major, maintainer-change and new-script updates are excluded.

Automated: every check must pass. Scanners report each check by its id.

postmortem

Renovate automerge rules and Dependabot auto-merge workflows exclude majors

command: postmortem harden --json
control: CB-DEP-UPD-002
coverage: auto

Remediation

1. Restrict automatic merging to minor and patch updates without the risk signals above, or disable it.

References

• Secure Supply Chain Consumption Framework (S2C2F) OpenSSF, guide, accessed 2026-10-16
• OWASP Top 10 CI/CD Security Risks OWASP, guide, accessed 2026-10-16

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-DEP-UPD-001 Propose dependency updates automatically
• related CB-DEP-EXEC-001 Block install-time scripts except for an allowlist

People and lifecycle