Third-party crypto libs pinned to audited versions

CWE-1357 (reliance on insufficiently trustworthy component) applies directly to floating version constraints on cryptographic libraries: crypto-js@^4.1.0 will silently upgrade to a version containing vulnerabilities or breaking changes during a routine npm install. PCI-DSS 4.0 Req-6.3 requires that security vulnerabilities in all system components be identified and protected — floating deps undermine this by allowing unvetted code into the cryptographic layer without a code review or security audit. SLSA L2 and SSDF PW.4 both require pinned, audited dependencies for supply chain integrity. A compromised crypto library release — even for 24 hours before detection — can backdoor encryption for all data processed during that window.

Pin all cryptographic library versions to exact semver in package.json and run npm audit as part of CI:

{
  "dependencies": {
    "jose": "5.2.4",
    "bcrypt": "5.1.1",
    "argon2": "0.31.2"
  }
}

Add a CI step that fails on moderate+ vulnerabilities:

# .github/workflows/security.yml
- name: Audit crypto dependencies
  run: npm audit --audit-level=moderate --production

Document each pinned version in docs/crypto-lib-audit.md with the audit date and the reviewer — this is the audit trail PCI-DSS Req-6.3 requires:

| Library  | Version | Audited    | By          | Notes                    |
|----------|---------|------------|-------------|---------------------------|
| jose     | 5.2.4   | 2026-03-15 | J. Smith    | No CVEs, maintained      |
| argon2   | 0.31.2  | 2026-03-15 | J. Smith    | Native binding, verified |