dependency-management
Safeguard articles tagged "dependency-management" — guides, analysis, and best practices for software supply chain and application security.
197 articles
When to Fork an Abandoned Dependency
Forking looks like a one-time action but is really a multi-year maintenance commitment. Here is a decision framework for when a fork beats patching, vendoring, or replacing.
node-forge Vulnerabilities: What Happened and What to Use Now
node-forge shipped signature-forgery and prototype-pollution fixes over the years, and its release cadence has gone quiet. Here is what each node-forge vulnerability meant and what to reach for today.
Node.js Backend Security Checklist
A working checklist for securing a Node.js backend: dependency hygiene, input validation, secrets, HTTP headers, and the CI gates that keep regressions out.
What package-lock.json Does and Why You Should Commit It
The main package-lock.json use is pinning your entire npm dependency tree to exact, integrity-checked versions so every install is reproducible. Here is what is inside it and why deleting it is a bad habit.
Java LTS Versions Explained: What They Mean for Security
A Java LTS release gets years of patches instead of six months, which makes your choice of version a security decision as much as a feature one.
How to Use a Java Package Manager Safely: A Security Review of Maven and Gradle
A Java package manager pulls in far more code than most teams realize. Here is how Maven and Gradle actually resolve dependencies, where the risk lives, and how to lock it down.
Go Module Security: sumdb, GOPROXY and Private Modules
How Go's checksum database actually protects you, where GOPROXY ordering bites, and the GOPRIVATE mistakes that leak internal module paths to public infrastructure.
@angular-builders/jest: Setup and Dependency Security
@angular-builders/jest lets you run ng test with Jest instead of Karma. Here is how it works, the version-alignment rule that trips teams up, and how to keep its dependency tree secure.
core-js 2.6.12: Vulnerabilities, EOL Status, and Upgrading to v3
Searching for core-js 2.6.12 vulnerabilities turns up no CVEs — the finding is the abandoned v2 line itself. What the deprecation actually means and how to migrate to core-js 3 cleanly.
react-router-dom and @types/react-router-dom: Versioning Done Right
Installing npm react router dom packages looks trivial until the types break. Here is how react-router-dom versions map to @types packages, and which combinations are wrong.
How to Use PyPI openpyxl Safely: Security Risks and Fixes
The openpyxl package on PyPI is safe for most workloads, but XML parsing and spreadsheet formula injection deserve attention. Here is what to watch for.
CVE-2023-45857: The Axios XSRF Token Leak Explained
How CVE-2023-45857 caused Axios to leak XSRF tokens to any host over cross-origin requests, who is affected, and the one-line upgrade that fixes it.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.