Description
Dependencies that are no longer imported or used are removed from manifests and lockfiles. This is checked regularly.
Rationale
Unused dependencies still get installed, still run install scripts, still show up in vulnerability reports, and still can be compromised. Removing them is the cheapest risk reduction.
Impact
None known.
Audit
- Run an unused-dependency analysis on each project.
- Check findings are handled.
Remediation
- Remove unused dependencies and regenerate the lockfile.
- Run the analysis periodically or in the pipeline.
References
- Secure Supply Chain Consumption Framework (S2C2F) OpenSSF, guide, accessed 2026-10-16
Mappings
| Framework | ID | Relation | Note |
|---|---|---|---|
| NIST SP 800-53 Rev. 55.1.1 | CM-7 | related |
How this control relates to the other framework's: equivalent, stricter, looser, partial or related.
Threats mitigated
| Taxonomy | ID | Note |
|---|---|---|
| Common Weakness Enumeration | CWE-1104 |
People and lifecycle
| Authors | Alice |
| Introduced in | v1.0.0 |
| Created, updated | 2026-10-16, 2026-10-16 |