DevSecOps Practice Hub

Dependency Management

Keep dependencies pinned, updated and reviewed so remediation is routine instead of an incident.

BeginnerDependency ManagementSupply ChainApplication

Where it fits in the lifecycle

  1. Plan
  2. Code
  3. Build
  4. Test
  5. Release
  6. Deploy
  7. Operate
  8. Monitor
  • Code Static analysis, secret detection and secure coding practices.
  • Build Dependency scanning, image scanning, SBOM generation and signing.

Overview

Automated update tooling proposes dependency bumps continuously, with grouping and scheduling so the volume is manageable and CI proves each change is safe.

Why it matters

Most vulnerable-dependency findings are fixed by an upgrade that already exists. The bottleneck is upgrade throughput, not detection.

How it works

  1. 01The bot reads manifests and lockfiles and checks upstream releases.
  2. 02Grouped merge requests are opened on a schedule.
  3. 03CI runs the full test suite on each proposal.
  4. 04Security updates are prioritised and can auto-merge on green.

Common tools

RenovateDependabotTrivyGitHubGitLabPython

Implementation examples

jsonRenovate configuration
{  "extends": ["config:recommended"],  "schedule": ["before 6am on monday"],  "packageRules": [    { "matchUpdateTypes": ["patch"], "groupName": "patch updates" },    { "matchDatasources": ["docker"], "pinDigests": true }  ],  "vulnerabilityAlerts": { "labels": ["security"], "schedule": ["at any time"] }}
Batches routine updates weekly while letting security updates through immediately.

Best practices

  • Commit lockfiles.
  • Pin container digests.
  • Keep the test suite fast enough to trust auto-merge.

Common mistakes

  • Disabling the bot because of volume instead of grouping updates.