# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-DEP-UPD-002
title: Require human review for risky updates
finding:
  title: Risky dependency updates are merged automatically
status: draft
profiles: [baseline]
risk:
  severity: medium
assessment: partial
tags: [updates, review]
description: |
  Updates are never merged without human review when they are a new major version, when the package changed maintainers or publisher, or when the new version adds install-time scripts or new dependencies. Automatic merging, if used, is limited to minor and patch updates that pass tests, and is not used in the hardened profile.
rationale: |
  Account takeovers and hostile maintainer changes show up as an ordinary new version. These signals are the ones that most often precede a malicious release.
impact: |
  More manual reviews.
audit:
  manual: |
    1. Review automatic merge rules.
    2. Check that major, maintainer-change and new-script updates are excluded.
  checks:
    - id: postmortem
      engine: postmortem
      description: "Renovate automerge rules and Dependabot auto-merge workflows exclude majors"
      spec:
        command: postmortem harden --json
        control: CB-DEP-UPD-002
        coverage: auto
remediation:
  manual: |
    1. Restrict automatic merging to minor and patch updates without the risk signals above, or disable it.
references:
  - title: Secure Supply Chain Consumption Framework (S2C2F)
    url: https://github.com/ossf/s2c2f
    publisher: OpenSSF
    kind: guide
    accessed: 2026-10-16
  - title: OWASP Top 10 CI/CD Security Risks
    url: https://owasp.org/www-project-top-10-ci-cd-security-risks/
    publisher: OWASP
    kind: guide
    accessed: 2026-10-16
mappings:
  - framework: nist-800-53r5
    framework_version: 5.1.1
    id: CM-3
    relation: related
threats:
  - framework: mitre-attack
    id: T1195.001
related_controls:
  - id: CB-DEP-UPD-001
    type: related
  - id: CB-DEP-EXEC-001
    type: related
authors:
  - name: Alice
    github: Sn0wAlice
introduced_in: 1.0.0
created: 2026-10-16
updated: 2026-10-16