Description
Any change that adds a direct dependency, or changes its source, needs approval from a person or group responsible for dependencies. Manifest files are protected so that this approval is required by the repository, not left to habit.
Rationale
Each new dependency brings its full transitive tree, its maintainers and their security practices into the product. It is one of the highest-impact lines of a change, and the easiest to overlook.
Impact
Changes that add dependencies take longer to merge.
Audit
- Check that manifest files require approval from a designated reviewer group.
- Sample recent additions and check they were reviewed against CB-DEP-VET-002.
Automated: every check must pass. Scanners report each check by its id.
postmortem
CODEOWNERS covers manifests and lockfiles; branch protection is not visible
command: postmortem harden --json
control: CB-DEP-VET-001
coverage: partial
Remediation
- Assign required reviewers for manifest files in the repository settings.
- Publish the review criteria (CB-DEP-VET-002).
References
- Concise Guide for Evaluating Open Source Software OpenSSF, guide, accessed 2026-10-16
- Secure Supply Chain Consumption Framework (S2C2F) OpenSSF, guide, accessed 2026-10-16
Mappings
| Framework | ID | Relation | Note |
|---|---|---|---|
| NIST SP 800-53 Rev. 55.1.1 | SA-9 | related | |
| NIST SP 800-53 Rev. 55.1.1 | SR-3 | related |
How this control relates to the other framework's: equivalent, stricter, looser, partial or related.
Threats mitigated
| Taxonomy | ID | Note |
|---|---|---|
| MITRE ATT&CK | T1195.001 |
Related controls
- related
CB-DEP-VET-002Evaluate new dependencies against written criteria
People and lifecycle
| Authors | Alice |
| Introduced in | v1.0.0 |
| Created, updated | 2026-10-16, 2026-10-16 |