dependency-management
Safeguard articles tagged "dependency-management" — guides, analysis, and best practices for software supply chain and application security.
197 articles
Fixing vulnerabilities in Gradle projects
Gradle's resolved dependency graph rarely matches build.gradle. Here's how to find, force-fix, and lock vulnerable transitive dependencies for good.
The ultimate guide to creating a secure Python package
A concrete, numbers-first guide to locking dependencies, signing releases, and scanning for CVEs when building a secure Python package.
What Is a Package Registry?
A package registry is the network service your package manager pulls code from. Here is how registries work, why they are a critical trust boundary, and how to secure what you download.
.NET and NuGet dependency vulnerability management
NuGet packages have delivered RATs, crypto stealers, and undisclosed data collection to .NET teams. Here's how to detect and defend against .NET/NuGet supply chain risk.
react-loader-spinner: A Security Guide
react-loader-spinner adds ready-made loading spinners to React apps. It is UI-only, so its security story is entirely about dependency hygiene and install-time provenance.
react-native-version-check: Prompting App Updates the Safe Way
react-native-version-check compares the installed app version against the store listing so you can prompt users to update. Here is how to wire it up and its security tradeoffs.
react-helmet-async: Is It Safe to Depend On in 2025?
react-helmet-async manages document head tags in React apps, but its maintenance history is bumpy. Here is what the package does, where the risk sits, and how to depend on it safely.
http-proxy-middleware on npm: Security Review and Safe Usage
http-proxy-middleware is a widely used npm proxy library that has shipped two notable CVEs. Here is what to pin, what to patch, and how to use it safely.
react-grid-layout: Package Health and Production Considerations
A production-focused review of the react-grid-layout npm package: what it does well, its maintenance profile, performance traps, and how to depend on it responsibly.
Building an Open Source Risk Intelligence Platform: Beyond Vulnerability Scanning
Vulnerability scanning is one dimension of open source risk. A true risk intelligence platform must also evaluate maintainer health, project sustainability, licensing, and malicious package threats.
com.google.code.gson: Using Gson Safely in Modern Java
Why the com.google.code.gson group ID looks so odd, what maintenance mode means for the library, and the configuration habits that keep Gson safe in modern Java services.
Writing a Deprecation Policy for Third-Party Components
End-of-life libraries leave codebases only when something forces them out. A written component deprecation policy with triggers, timelines, and CI gates does the forcing on your schedule, not an attacker's.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.