dependency-management
Safeguard articles tagged "dependency-management" — guides, analysis, and best practices for software supply chain and application security.
197 articles
netty-handler: TLS in Netty and Keeping It Patched
netty-handler is where Netty's TLS lives, which makes it the module scanners flag most. What SslHandler actually does, the hostname-verification gotcha, and the patch cadence to keep.
Is the npm express Package Safe? A Security Review
The npm express package is the most widely used Node.js web framework, and it is safe to run today if you stay on a maintained version and watch its small dependencies. Here is the security picture.
webpack-bundle-analyzer: Find Bloat and Risky Dependencies in Your Bundle
webpack bundle analyzer turns your build output into a zoomable treemap. Used well, it finds not just bloat but duplicated packages, surprise transitive dependencies, and code you never meant to ship.
Is uglifyjs-webpack-plugin Safe to Use in 2025? What to Migrate To
uglifyjs-webpack-plugin is deprecated and built on the unmaintained uglify-es. Here is why you should migrate to terser-webpack-plugin and how to do it cleanly.
jackson-core Maven: What It Is and Where the Risk Lives
jackson-core is the low-level streaming engine behind Jackson, added via Maven. Here is what the artifact does, why it is safer than jackson-databind, and how to keep the whole stack patched.
log4j Remediation: How to Fully Patch Log4Shell
A practical log4j remediation walkthrough: which versions actually fix Log4Shell, how to find the library transitively, and what to do when you cannot upgrade yet.
FileSaver.js (file-saver): Package Review and Download Security
The file saver npm package still powers client-side downloads in millions of builds, but it has not shipped a release since 2020. Here is what that means for your dependency tree.
What Is a Node.js Backend? A Security Guide for Server-Side JavaScript
A practical look at building a Node.js backend that holds up in production, from dependency risk to input validation, with real config you can copy.
npm Vulnerabilities: Detection, Triage, and Fix Workflow
Known CVEs and hostile packages are two different problems that share one dependency tree. A workflow for detecting npm vulnerabilities, triaging by reachability, and fixing without breaking your lockfile.
spring-context: The Dependency at the Heart of Spring (and Its CVEs)
spring-context is the artifact that gives you Spring's ApplicationContext, and it drags four more Spring modules into your build. Here is what it does, what it pulls in, and the CVEs that have hit it.
What jQuery Migrate Is and How to Use It Securely
jQuery Migrate helps older code survive newer jQuery releases, but leaning on it can quietly keep you on a vulnerable jQuery version. Here is how to use it without inheriting old XSS bugs.
SnakeYAML in Maven: How to Use It Safely and Avoid CVE-2022-1471
Adding SnakeYAML as a Maven dependency is fine, but parsing untrusted YAML with the default constructor is not. Here is how to pin a safe version and lock down deserialization.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.