# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-DEP-VET-003
title: Remove unused dependencies
finding:
  title: The project declares dependencies it does not use
status: draft
profiles: [baseline]
risk:
  severity: low
assessment: partial
tags: [minimization]
description: |
  Dependencies that are no longer imported or used are removed from manifests and lockfiles. This is checked regularly.
rationale: |
  Unused dependencies still get installed, still run install scripts, still show up in vulnerability reports, and still can be compromised. Removing them is the cheapest risk reduction.
impact: |
  None known.
audit:
  manual: |
    1. Run an unused-dependency analysis on each project.
    2. Check findings are handled.
remediation:
  manual: |
    1. Remove unused dependencies and regenerate the lockfile.
    2. Run the analysis periodically or in the pipeline.
references:
  - title: Secure Supply Chain Consumption Framework (S2C2F)
    url: https://github.com/ossf/s2c2f
    publisher: OpenSSF
    kind: guide
    accessed: 2026-10-16
mappings:
  - framework: nist-800-53r5
    framework_version: 5.1.1
    id: CM-7
    relation: related
threats:
  - framework: cwe
    id: CWE-1104
authors:
  - name: Alice
    github: Sn0wAlice
introduced_in: 1.0.0
created: 2026-10-16
updated: 2026-10-16