#dependencies
Tagged “dependencies”
4 articlesCISA's new OSS guidance puts a four-letter scoreboard next to every dependency you ship
The CISA report 'Open Source Software: Security Principles and Practices' argues open source can be as safe as proprietary software, provided consumers score each component against a C4 framework (Codebase, Community, Conduct, Configuration). For any CI/CD team selling into regulated buyers, that scoreboard is going to arrive as an audit checklist.
Aug 3, 2026 · Tomás VegaSupply chain securityGitLab tries to auto-fix the transitive-dep problem it keeps quantifying
GitLab has moved Dependency Scanning Auto-Remediation into beta, aimed squarely at the transitive supply-chain risk it just spent a research cycle measuring. The interesting question is not whether the fix ships, but whether anyone downstream trusts the bot enough to merge it.
Jul 17, 2026 · Tomás VegaSupply-chain securityAikido buys Root to patch open source in place, without the upgrade dance
Aikido Security acquired Root, a company whose technology fixes known vulnerabilities directly inside the package version you already run. The trade-off: someone other than upstream now decides what your dependency looks like on disk.
Jul 1, 2026 · Tomás VegaSecurity & supply chainCI is the wrong place to first hear about your npm dependencies
A DevOps.com essay argues dependency-security feedback that only arrives after a push and a pipeline run is structurally too late for Node projects, where transitive findings can outnumber direct ones. The diagnosis is right. The prescription deserves more scrutiny than the post gives it.
Jun 29, 2026 · Tomás Vega