Dependency update policy documented
Why it matters
Without automated dependency update tooling, dependency updates are deferred indefinitely until a breaking version or security incident forces a painful large-batch upgrade. CWE-1104 and SSDF SP 800-218 PW.4.4 identify stale dependencies as a supply-chain risk. Projects that skip minor versions for 12+ months accumulate multiple breaking changes between their installed version and the current release, turning a routine update into a multi-day migration. Dependabot and Renovate send small, reviewable PRs that keep the gap manageable.
Severity rationale
Info because absent update automation does not break current functionality but guarantees that the dependency graph drifts toward stale, potentially vulnerable versions without any active detection.
Remediation
Add Dependabot to get automated weekly PRs for outdated dependencies. Create .github/dependabot.yml:
version: 2
updates:
- package-ecosystem: "npm"
directory: "/"
schedule:
interval: "weekly"
groups:
dev-dependencies:
patterns: ["@types/*", "eslint*", "prettier*", "vitest*"]
Alternatively, Renovate (free for public and private repos) offers more granular configuration including auto-merge for patch updates. Both tools are zero-maintenance once configured.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Code Quality Essentials Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- cwe · CWE-1104 — Use of Unmaintained Third-Party Components
- ssdf:800-218 · PW.4.4 — Verify third-party software is compliant with security requirements
Taxons
History
- 2026-04-18·v1.0.0·Initial import from code-quality-essentials·automated