Best practices for maintaining dependencies

Guidance and recommendations for maintaining the dependencies you use, including GitHub's security products that can help.

이 문서의 내용

Best practices for maintaining dependencies

Staying up to date on dependencies is crucial to maintaining a secure software environment. Here are some recommendations:

Adopt security-focused dependency management tools

  • Use and set up tools that scan your dependencies for vulnerabilities and automatically suggest updates.
  • Ensure these tools are integrated into your CI/CD pipeline for continuous monitoring and updating.
  • Set up your processes to follow semantic versioning to avoid breaking changes.

Perform regular vulnerability scans and audits

  • Schedule regular dependency audits and dependency scans to identify outdated or vulnerable dependencies.

Automate security patch management

  • Configure your dependency management tools to automatically apply security patches.
  • Set up automated pull requests for critical security updates so they can be reviewed and merged quickly.

Enforce policies on the use of dependencies

  • Implement policies that enforce the use of secure versions of dependencies.
  • Use tools that can block merging of pull requests if they introduce vulnerabilities or fail to update vulnerable dependencies.

Integrate security testing in CI/CD

  • Incorporate security testing tools into your CI/CD pipeline.
  • Ensure that dependency updates are automatically tested for security compliance.

Use lock files and dependency pinning

  • Use lock files (for example, package-lock.json, yarn.lock, Pipfile.lock) to pin dependencies to known secure versions.
  • Regularly update and review these lock files to ensure dependencies are up-to-date without unintended security issues.

Monitor security advisories

  • Subscribe to security advisories for the languages and frameworks you use.
  • Automate the integration of advisories into your development workflow to stay informed of new vulnerabilities.
  • Keep an eye on the dashboards provided by your dependency management tools.
  • Be aware of critical updates, especially security patches, and prioritize them.

Version control and change management

  • Track dependency changes in version control (for example, through automated pull requests).
  • Conduct regular code reviews to ensure updates do not introduce new vulnerabilities.

Training and awareness

  • Educate your development and operations teams about the importance of keeping dependencies secure and up-to-date.
  • Provide training on how to use dependency management and security tools effectively.

Response plan for vulnerabilities

  • Have a clear incident response plan for when vulnerabilities are identified in dependencies.
  • Ensure the team knows how to quickly address and remediate security issues.

By following these practices, you can significantly reduce the risk posed by outdated and vulnerable dependencies and maintain a more secure environment.

How GitHub can help

GitHub offers several security features that can help maintain the security of your codebases:

Dependency Graph

  • Provides a tabular representation of your project's dependencies.
  • The graph helps you understand the dependencies of your project and GitHub uses this to identify vulnerable dependencies.
  • For more information, see 종속성 그래프 정보.

Dependency review

  • Is integrated into your CI/CD pipeline, and allows you to catch insecure dependencies in your code at every pull request. For more information, see 종속성 검토 정보.

  • The 종속성 검토 작업 is a tool that can block the merging of pull requests if they introduce vulnerabilities or fail to update vulnerable dependencies. For more information, see "About the 종속성 검토 작업" in 종속성 검토 정보.

Dependabot

Security Advisories

  • Private vulnerability reporting: Allows maintainers to privately discuss, fix, and publish security advisories for their repositories. For more information, see 보안 취약성 비공개 보고.

  • GitHub Advisory Database: A database of security advisories that is used by Dependabot to identify vulnerabilities in your dependencies. For more information, see GitHub Advisory Database 정보.

Security overview

  • You can keep an eye on the dashboards on the security overview page, which provide insights about your organization or enterprise's security landscape and progress. It helps users identify repositories that need attention and monitor the health of their application security program. For more information, see 보안 개요.

Security policy

For additional guidance across the whole supply chain using GitHub's security features, see 엔드투엔드 공급망 보안.