Description
Development, test and build-only dependencies are declared separately from runtime ones, and production artifacts (images, packages, bundles) contain only runtime dependencies.
Rationale
Development dependencies are often the largest part of the tree. Shipping them grows the attack surface of the running system for no benefit.
Impact
Dependency groups must be maintained correctly.
Audit
- Check that manifests separate runtime and development dependencies.
- Inspect a production artifact and check that development dependencies are absent.
Automated: every check must pass. Scanners report each check by its id.
postmortem
dev tools in production deps; the last Dockerfile stage omits dev deps
command: postmortem harden --json
control: CB-DEP-VET-004
coverage: partial
Remediation
- Move development dependencies to the development group.
- Install only runtime dependencies in the production build step.
References
- Secure Supply Chain Consumption Framework (S2C2F) OpenSSF, guide, accessed 2026-10-16
Mappings
| Framework | ID | Relation | Note |
|---|---|---|---|
| NIST SP 800-53 Rev. 55.1.1 | CM-7 | related |
How this control relates to the other framework's: equivalent, stricter, looser, partial or related.
Related controls
- related
CB-DEP-INV-001Produce and keep an SBOM for every release
People and lifecycle
| Authors | Alice |
| Introduced in | v1.0.0 |
| Created, updated | 2026-10-16, 2026-10-16 |