Dependency Security

Verify Dependency Integrity Before Installation

A dependency declaration such as library = 2.4.1 tells a package manager which release you intend to use. It does not, by itself, prove that the bytes being installed are the same bytes you previously reviewed, tested, or approved. That distinction matters when dependencies cross a trust boundary. Packages may come through registries, mirrors, caches, proxies, build systems, or internal artifact stores. If unexpected bytes are accepted somewhere along that path, a familiar package name and version can create false confidence.