System and software updates applied timely

CMMC 2.0 SI.L1-3.14.5 (NIST 800-171r2 3.14.5) requires that organizations perform periodic scans and real-time monitoring of organizational systems, including applying security-relevant software updates. Dependencies that are multiple major versions behind their latest releases carry unpatched CVEs that are often publicly documented and weaponized. A Next.js 12 installation, for example, carries CVEs fixed in Next.js 13+ that attackers actively exploit. Without automated tooling (Dependabot, Renovate) and a CI/CD pipeline, updates depend entirely on developer vigilance — a process that fails silently. CWE-1395 and SSDF RV.2 require update cadence as a verifiable practice.

Configure Dependabot for weekly automated update PRs and pin your Node.js version to an active LTS release. Outdated runtimes are a CMMC finding independent of application code:

# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: 'npm'
    directory: '/'
    schedule:
      interval: 'weekly'
    versioning-strategy: auto

Pin the Node.js runtime in .nvmrc and in package.json:

// package.json
{
  "engines": { "node": ">=20.0.0", "npm": ">=10.0.0" }
}

# .nvmrc
20

Add a deploy workflow that runs npm audit --audit-level=high before every production deployment — builds that introduce new critical CVEs are blocked at CI rather than discovered post-deploy. Check key framework versions quarterly against their latest releases; more than one major version behind warrants an immediate upgrade plan.