Dependencies are reasonably current
Why it matters
Production dependencies two or more major versions behind stable miss security patches, performance improvements, and API reliability fixes that maintainers actively backport to current releases. CWE-1104 (Use of Unmaintained Third Party Components) applies directly. SSDF PS.3 requires tracking dependency freshness as a security control. Using React 17 when React 19 is stable, or Next.js 12 when Next.js 15 is stable, means operating on code whose known vulnerabilities have been fixed — just not for you.
Severity rationale
Medium because significantly outdated production dependencies accumulate known security vulnerabilities and miss critical patches, but do not immediately break functionality.
Remediation
Check what is outdated and update framework dependencies first:
# See all outdated packages
npm outdated
# Update to latest
npm install next@latest react@latest react-dom@latest
# Interactive update tool with changelogs
npx npm-check-updates -u
Read the migration guide before upgrading each major version. Test thoroughly after every major upgrade before proceeding to the next one — skipping majors compounds the upgrade difficulty. For deeper supply chain analysis, the Dependency & Supply Chain Audit covers lockfile integrity and supply chain security.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Code Maintainability Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- cwe · CWE-1104 — Use of Unmaintained Third Party Components
- ssdf:800-218 · PS.3 — Archive and Protect Each Software Release
- slsa:1.0 · dependency-management — Dependency Version Management
- soc2:2017 · CC8.1 — Change management
Taxons
History
- 2026-04-18·v1.0.0·Initial import from code-maintainability·automated
- 2026-07-06·v1.0.1·Add SOC 2 TSC mapping (CC8.1) from the verified compliance crosswalk register (docs/compliance/).·by soc2-mapping-enrichment-ship-2