How much dependency governance does a growing product need?

Dependencies let a small team build on maintained, reviewed work instead of recreating every capability. They also add code, transitive packages, release cycles, maintainers, licenses, and vulnerabilities the product team does not control. Governance should make those obligations visible without blocking routine updates.

Know what ships and why

Maintain an inventory of direct and transitive runtime and build dependencies, versions, source, purpose, owner, and where practical a software bill of materials. Remove packages whose value no longer exceeds their attack surface and maintenance cost. A lockfile supports repeatable resolution but does not make an old version safe.

Set a proportionate update process

• Automate update proposals and run the same tests required for product changes.
• Review release notes and compatibility for material upgrades.
• Define response targets from severity, exploitability, exposure, and business impact rather than a score alone.
• Track exceptions with an owner, rationale, compensating control, and review date.
• Identify abandoned, renamed, or compromised packages and plan replacement.

Use authoritative vulnerability signals

OWASP recommends continuous identification, analysis, remediation, and monitoring of vulnerable dependencies. CISA’s Known Exploited Vulnerabilities catalog records vulnerabilities known to be exploited in the wild and can help prioritize action alongside product exposure and vendor guidance. Scanning is an input to a decision, not proof that a release is secure.

Protect how dependencies enter the build

Restrict package-publication and registry credentials, review unexpected ownership or source changes, avoid unreviewed install scripts, verify provenance where the ecosystem supports it, and keep build permissions minimal. NIST’s Secure Software Development Framework includes practices for protecting software components and responding to vulnerabilities throughout the lifecycle.

Kiwi can help establish dependency automation and maintenance practices with an embedded team. Formal supply-chain assurance, license opinions, and incident response require qualified security and legal owners.