https://nalar.dev/tags/dependencies/ Recent content in Dependencies on Nalar Hugo en-us Tue, 01 Sep 2026 00:00:00 +0700 https://nalar.dev/reduce-software-supply-chain-risk-with-dependency-controls/ Tue, 01 Sep 2026 00:00:00 +0700 https://nalar.dev/reduce-software-supply-chain-risk-with-dependency-controls/ <p>Modern applications routinely execute code downloaded from package registries, container registries, build actions, and language-specific ecosystems. That convenience creates supply chain risk: an attacker does not need to compromise your source repository if they can compromise something your build trusts.</p> <p>No single control eliminates this risk. The practical approach is to reduce unnecessary trust and make dependency changes visible.</p> <h2 id="treat-dependency-resolution-as-a-security-boundary">Treat dependency resolution as a security boundary</h2> <p>A manifest may specify broad version ranges, while a lockfile records the exact dependency graph selected for a build.</p>