# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-DEP-VET-004
title: Ship only production dependencies
finding:
  title: Development and test dependencies are installed in production artifacts
status: draft
profiles: [baseline]
risk:
  severity: low
assessment: partial
tags: [minimization, build]
description: |
  Development, test and build-only dependencies are declared separately from runtime ones, and production artifacts (images, packages, bundles) contain only runtime dependencies.
rationale: |
  Development dependencies are often the largest part of the tree. Shipping them grows the attack surface of the running system for no benefit.
impact: |
  Dependency groups must be maintained correctly.
audit:
  manual: |
    1. Check that manifests separate runtime and development dependencies.
    2. Inspect a production artifact and check that development dependencies are absent.
  checks:
    - id: postmortem
      engine: postmortem
      description: "dev tools in production deps; the last Dockerfile stage omits dev deps"
      spec:
        command: postmortem harden --json
        control: CB-DEP-VET-004
        coverage: partial
remediation:
  manual: |
    1. Move development dependencies to the development group.
    2. Install only runtime dependencies in the production build step.
references:
  - title: Secure Supply Chain Consumption Framework (S2C2F)
    url: https://github.com/ossf/s2c2f
    publisher: OpenSSF
    kind: guide
    accessed: 2026-10-16
mappings:
  - framework: nist-800-53r5
    framework_version: 5.1.1
    id: CM-7
    relation: related
related_controls:
  - id: CB-DEP-INV-001
    type: related
authors:
  - name: Alice
    github: Sn0wAlice
introduced_in: 1.0.0
created: 2026-10-16
updated: 2026-10-16