Reduce Software Supply Chain Risk with Dependency Controls
Modern applications routinely execute code downloaded from package registries, container registries, build actions, and language-specific ecosystems. That convenience creates supply chain risk: an attacker does not need to compromise your source repository if they can compromise something your build trusts.
No single control eliminates this risk. The practical approach is to reduce unnecessary trust and make dependency changes visible.
Treat dependency resolution as a security boundary A manifest may specify broad version ranges, while a lockfile records the exact dependency graph selected for a build.
