dependency-management
Safeguard articles tagged "dependency-management" — guides, analysis, and best practices for software supply chain and application security.
197 articles
org.apache.tomcat.embed: Embedded Tomcat Versions and Vulnerabilities
org.apache.tomcat.embed ships inside almost every Spring Boot jar, and its CVEs follow it there. Here is how to find your real embedded Tomcat version and patch it.
Python on macOS: A Security-Minded Setup Guide
Running Python on Mac OS is easy to get wrong in ways that bite you later. Here is how to install and isolate Python for Mac OS without the common security traps.
jQuery 3.6.0 Vulnerabilities: What Is Actually Exploitable
Scanners keep flagging jQuery 3.6.0 as vulnerable — but jQuery core in that version has no known direct CVEs. Here is what the alerts really mean and where the exploitable risk actually lives.
org.springframework:spring-web: Known CVEs and How to Stay Patched
A security-focused look at org.springframework:spring-web, including the Spring4Shell RCE, how spring-web relates to spring-webmvc, and how to keep the dependency safe.
react-native-walkthrough-tooltip: Security and Maintenance
react-native-walkthrough-tooltip is popular but inactively maintained. Here is how to assess its risk, decide whether to keep it, and manage aging RN dependencies.
npm-force-resolutions: Security Review and Safe Usage
npm-force-resolutions pins vulnerable transitive dependencies to safe versions on older npm. Here is how it works, its risks, and why native npm overrides now beat it.
Advanced Python: The Security-Focused Patterns Senior Developers Should Master
Advanced Python is not about clever one-liners. The patterns that separate senior engineers are the ones that keep code safe: safe deserialization, controlled subprocess calls, and disciplined dependency use.
Webpack Latest Version: Why Staying Current Is a Security Move
The webpack latest version sits in the 5.x line and updates frequently. Here is how to check which version you run, why staying current matters for security, and how to upgrade safely.
jQuery UI Latest Version: Where It Stands and What to Do About It
The jQuery UI latest version is in the 1.14.x line, released in 2024, and the project is now in maintenance mode. Here is what that means for your dependency and its security.
usehooks-ts: A Typed React Hooks Library Reviewed
usehooks-ts packs 30+ typed React hooks into a tree-shakable package with a single dependency. Here is what it does well, where it is aging, and how to vet it before adoption.
Mend Security Explained: What Mend.io Does and How It Works
A clear look at Mend security: what the platform formerly known as WhiteSource covers, how its automated remediation works, and where its strengths and gaps lie.
Is the npm qs Package Safe? A Security Review of qs
The npm qs package parses query strings under most Express apps, and a prototype pollution flaw once let a single URL hang your Node process. Here is what to check and how to use qs safely.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.