Automating Dependency Audits

By Michael Samuel Naeem · May 19, 2025 · 7 min read

Log4Shell taught teams that transitive dependencies run in production even when application code never mentions them. Manual npm audit before releases misses CVEs published Tuesday afternoon. Automated dependency auditing turns advisory feeds into enforced SLAs: detect, assign, patch, verify—on every pull request and nightly against what is actually deployed.

Lockfiles are the source of truth

Commit lockfiles (package-lock.json, Cargo.lock, poetry.lock). CI must install with frozen resolution:

npm ci
cargo build --locked

Scanning package.json ranges without lockfiles imagines versions you might not ship. SBOM tools consume resolved graphs.

CI scanning with OSV-Scanner

- name: OSV scan
  uses: google/osv-scanner-action@v1
  with:
    scan-args: |-
      --lockfile=package-lock.json
      --severity=HIGH,CRITICAL

OSV aggregates advisories across ecosystems. Fail only on diff-introduced vulns during PRs using baseline comparison.

Dependabot / Renovate configuration

# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: npm
    directory: /
    schedule:
      interval: weekly
    groups:
      production:
        dependency-type: production
        patterns: ["*"]

Group minor bumps to reduce PR noise. Auto-merge patch updates when CI is green and coverage is adequate.

Remediation SLAs

"Exploitable" means reachable from your attack surface—scanner reachability analysis or manual trace.

Overrides with accountability

"overrides": {
  "lodash": "4.17.21"
}

Require ticket reference in commit message. Scheduled job checks if override still needed when upstream releases fix.

Deploy-time verification

Promote only artifacts scanned at build SHA. Compare production SBOM to latest scan—drift indicates manual hotfix or registry substitution. Cosign signatures bind image digest to CI run that passed audit.

Report MTTR for dependency CVEs monthly. Celebrate burn-down of legacy baseline, not zero findings fantasy—maintainers publish CVEs continuously.

Promote only artifacts scanned at build SHA. Compare production SBOM to latest scan—drift indicates manual hotfix or registry substitution. Cosign signatures bind image to CI run.

Override packages require ticket reference and scheduled re-check when upstream releases fix. Risk acceptance without expiry becomes permanent vulnerability.

Report MTTR for dependency CVEs monthly. Celebrate baseline burn-down, not zero findings fantasy—maintainers publish CVEs continuously. CISA KEV catalog prioritizes exploited issues for immediate action.

Run the change through your standard PR checklist: tests, observability, and a two-minute rollback drill in staging. Small operational habits accumulate into systems that survive on-call nights without heroics.

Share a short write-up in your engineering channel after rollout: what shipped, what metric you watch, and who owns follow-up. That closes the loop for teammates who were not in the PR and surfaces gaps in docs before the next person repeats the same investigation.

Rollout and ownership

Teams shipping this capability should wire observability before calling the work done: metrics on the user-visible outcome the control protects, alerts linked to runbook steps, and at least one automated test covering the last incident class you care about. Slice dashboards by region and device during rollout because global averages hide bad canaries. When vendors, routes, or org structure change, revisit assumptions from launch week—they age faster than code. Document rollback commands in the runbook header so on-call does not rediscover steps during pagination. Cross-functional review after major traffic shifts keeps product, platform, and security aligned on the leading metric.

Rollout and ownership

Teams shipping this capability should wire observability before calling the work done: metrics on the user-visible outcome the control protects, alerts linked to runbook steps, and at least one automated test covering the last incident class you care about. Slice dashboards by region and device during rollout because global averages hide bad canaries. When vendors, routes, or org structure change, revisit assumptions from launch week—they age faster than code. Document rollback commands in the runbook header so on-call does not rediscover steps during pagination. Cross-functional review after major traffic shifts keeps product, platform, and security aligned on the leading metric.

Rollout and ownership

Teams shipping this capability should wire observability before calling the work done: metrics on the user-visible outcome the control protects, alerts linked to runbook steps, and at least one automated test covering the last incident class you care about. Slice dashboards by region and device during rollout because global averages hide bad canaries. When vendors, routes, or org structure change, revisit assumptions from launch week—they age faster than code. Document rollback commands in the runbook header so on-call does not rediscover steps during pagination. Cross-functional review after major traffic shifts keeps product, platform, and security aligned on the leading metric.

Rollout and ownership

Teams shipping this capability should wire observability before calling the work done: metrics on the user-visible outcome the control protects, alerts linked to runbook steps, and at least one automated test covering the last incident class you care about. Slice dashboards by region and device during rollout because global averages hide bad canaries. When vendors, routes, or org structure change, revisit assumptions from launch week—they age faster than code. Document rollback commands in the runbook header so on-call does not rediscover steps during pagination. Cross-functional review after major traffic shifts keeps product, platform, and security aligned on the leading metric.

Rollout and ownership

Teams shipping this capability should wire observability before calling the work done: metrics on the user-visible outcome the control protects, alerts linked to runbook steps, and at least one automated test covering the last incident class you care about. Slice dashboards by region and device during rollout because global averages hide bad canaries. When vendors, routes, or org structure change, revisit assumptions from launch week—they age faster than code. Document rollback commands in the runbook header so on-call does not rediscover steps during pagination. Cross-functional review after major traffic shifts keeps product, platform, and security aligned on the leading metric.

Security work around sec dependency audit automation fails when it is treated as a checklist instead of a feedback loop. Start from a threat model: who is the adversary, what is the asset, and which control fails closed if misconfigured. For sec dependency audit automation, I write the abuse cases first — credential stuffing, dependency CVE, log exfiltration, CSRF on cookie sessions — then map each to a detection signal and an owner.

Controls that actually change outcomes

Wire these into CI where possible. A control that only lives in a wiki page will not survive the next on-call rotation.

Incident-shaped verification

Run a tabletop: assume the primary control for sec dependency audit automation failed at 02:00. Who gets paged? What is the first command? How do you revoke access or roll credentials without cascading outages? If you cannot answer in under five minutes, the design is incomplete.

Measurement

Track mean time to remediate findings related to sec dependency audit automation, false-positive rate of scanners, and number of production changes that bypass the gate. Celebrate burn-down of legacy exceptions with expiry dates — permanent exceptions are just vulnerabilities with paperwork.

Pitfalls specific to this domain

Avoid denylist-only validation, logging secrets "temporarily," and blocking every advisory at severity informational. Prefer allowlists, structured redaction, and severity+reachability for gates. Document the dual-credential or dual-key window whenever rotation is involved so operators do not revoke early.

Resources

• OSV.dev database
• GitHub Dependabot documentation
• Renovate bot documentation
• CISA known exploited vulnerabilities catalog
• OpenSSF Scorecard

Govulncheck and compiled binaries

Go services should run govulncheck ./... in CI — it reports vulnerabilities only when affected symbols appear in compiled binaries, closer to true reachability than lockfile-only scans. Pair with go build -trimpath reproducible builds for SBOM alignment.

CycloneDX in release pipeline

Attach SBOM JSON to GitHub release and container OCI artifact. When CVE publishes, query SBOM across all services for affected package version in minutes. Sigstore cosign attestation binds SBOM hash to CI run that passed OSV gate — admission controller rejects drift.

Developer training

Monthly brown-bag reading one GHSA entry end-to-end — teams learn reachability analysis faster than policy slides. Include worked example of npm override with test proving fix.

Monorepo per-package scans

Matrix CI runs audit in each workspace producing artifacts — root-only scan misses vulnerable transitive in unpublished packages.