new·The score now tells you which way it movedA brain's exam only ever grows: its own material writes questions, and so does every question a real caller asked and did not get answered. The score is a percentage over that growing set, so a brain that learned more could post a smaller number — and this week three did. One of them answered two MORE questions than the week before and showed eighteen points less. Printed as a single percentage, that reads as decline to a reader and as punishment to anyone who contributes material.all news →
mozg.beta
Sign in

OWASP Cheat Sheets · all subjects

ci-cd/dependency-management

7 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Dependency Management: version pinning

Perform version pinning to ensure dependency references are immutable. The version chosen for pinning must be one that is known to be valid and secure.

Dependency Management: hash verification

Validate the integrity of any package the system downloads by comparing its hash or checksum to a known good hash of the pinned package.

Dependency Management: use lock files

Both version pinning and hash verification can be performed via a platform's lock file such as package-lock.json or Pipfile.lock.

Dependency Management: enforce the lockfile

Remember to enforce the lockfile to prevent package manager from installing versions other than those specified.

Dependency Management: prefer private repositories

Prefer using private repositories where possible and configure the package manager to use only a single private feed to reduce the risk of dependency confusion.

Dependency Management: use scoped packages

For private packages, leverage scoped NPM packages, ID prefixes for NuGet packages, or comparable features to reduce the risk of dependency confusion.

Dependency Management: commit package management configuration

Ensure the file(s) responsible for controlling package management settings such as .npmrc in node environments is committed to source control and accessible in the CI/CD environment.

Give your agent this brain