# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-DEP-VET-001
title: Review every new direct dependency before merge
finding:
  title: New dependencies can be added without review
status: draft
profiles: [baseline]
risk:
  severity: medium
assessment: partial
tags: [review, code-owners]
description: |
  Any change that adds a direct dependency, or changes its source, needs approval from a person or group responsible for dependencies. Manifest files are protected so that this approval is required by the repository, not left to habit.
rationale: |
  Each new dependency brings its full transitive tree, its maintainers and their security practices into the product. It is one of the highest-impact lines of a change, and the easiest to overlook.
impact: |
  Changes that add dependencies take longer to merge.
audit:
  manual: |
    1. Check that manifest files require approval from a designated reviewer group.
    2. Sample recent additions and check they were reviewed against CB-DEP-VET-002.
  checks:
    - id: postmortem
      engine: postmortem
      description: "CODEOWNERS covers manifests and lockfiles; branch protection is not visible"
      spec:
        command: postmortem harden --json
        control: CB-DEP-VET-001
        coverage: partial
remediation:
  manual: |
    1. Assign required reviewers for manifest files in the repository settings.
    2. Publish the review criteria (CB-DEP-VET-002).
references:
  - title: Concise Guide for Evaluating Open Source Software
    url: https://best.openssf.org/Concise-Guide-for-Evaluating-Open-Source-Software
    publisher: OpenSSF
    kind: guide
    accessed: 2026-10-16
  - title: Secure Supply Chain Consumption Framework (S2C2F)
    url: https://github.com/ossf/s2c2f
    publisher: OpenSSF
    kind: guide
    accessed: 2026-10-16
mappings:
  - framework: nist-800-53r5
    framework_version: 5.1.1
    id: SA-9
    relation: related
  - framework: nist-800-53r5
    framework_version: 5.1.1
    id: SR-3
    relation: related
  - framework: iso27001-2022
    framework_version: '2022'
    id: A.5.21
    relation: related
threats:
  - framework: mitre-attack
    id: T1195.001
related_controls:
  - id: CB-DEP-VET-002
    type: related
authors:
  - name: Alice
    github: Sn0wAlice
introduced_in: 1.0.0
created: 2026-10-16
updated: 2026-10-16