Dependency Risk & SCA

Publication measures real exposure — how long a known flaw ran in production. Detection start hides scanning latency, because a slow or missed scan silently rewinds the clock. Mature programs record both timestamps and drive the deadline from publication.

Whenever the code reaches the dependency by a mechanism the analyser cannot draw an edge for — dynamic imports, reflection, framework wiring, deserialization — or when it modelled the wrong entry points. Unreachable is weak negative evidence, not proof.

Run two tracks. Land a local override now, scoped and tested, with an owner and a removal trigger tied to the upstream change. In parallel push the pull request itself: minimal diff, tests, the advisory cited, escalated through the project's security contact rather than a public thread.

Freezing stops other changes so the fix is the only thing moving; pinning holds the dependency at an exact known-good version so a rebuild cannot drift; rolling forward ships the fix through the normal train. Choose by exposure and by how much unrelated change the fix drags along.

Cut the attack path and the blast radius: pre-filter or transcode documents before the parser sees them, run it unprivileged, network-denied and resource-capped one document at a time, alert on crashes, and give the control an owner and a review date.

No. An update bot is a remediation channel, not a detector: it proposes version changes where a newer version exists and it can rewrite a manifest. Up-to-date and not-vulnerable are overlapping sets, not the same set.

Design so most requests never reach a human, delegate the rest to the teams that own the risk, define what happens when nobody responds, and make every exception expire. A gate's real failure is bypass, not a bad approval.

Tier the review by blast radius: most dependencies clear on automated signals alone, a smaller set needs a written human review, and the highest-impact set needs a reviewer outside the adopting team plus a recorded decision with an owner and an expiry.

A raw finding count measures scanner coverage and estate size, not risk. It double-counts one shared component across many services, rises when coverage improves, and treats every finding as equal. Report evidence-driven measures instead.

Read the individual checks, not the composite number. Checks such as code review, branch protection, pinned dependencies and a published security policy are evidence about how a project is run — not about whether its code is correct.

An EPSS score is an absolute probability, so a score cut holds a fixed risk bar and lets queue volume float. A percentile ranks a CVE against all others, so a percentile cut holds volume steady instead.

Advisory records are mutable: withdrawn, disputed, rejected or corrected after publication. Refresh the local advisory data first, since a stale mirror is the usual cause, confirm the withdrawal at the source, then override by identifier with an expiry.

It compares a release against the package's own previous release and source repository: newly declared install hooks, files present in no commit, obfuscated blobs, a changed publisher. The output is quarantine for review, not an outright block.

A merged pull request and a closed ticket prove intent, not state. Proof is a chain: the fixed version inside a built artifact, that artifact identified by digest, that digest running in every environment, and a re-scan of the running inventory returning no matches.

No. A manifest-based scanner found nothing because no lockfile ships beside the binary. The result describes the scanner's input, not the artifact. Go binaries embed their module list, so an artifact-level scan still enumerates them.

You lose the one-to-one mapping between a symptom and a single change. Bisecting now happens inside the batch rather than across history, and reverting is all-or-nothing, so undoing one bad member also undoes nineteen good ones and reopens their exposure.

Split each refresh into what a machine can reproduce and what it cannot. Auto-approve lock changes CI regenerates byte-for-byte from the manifest; send only the residue - hash-only changes, new packages, moved sources - to a named human.

Resolve ownership at display time from a live service catalogue rather than a name typed once into a ticket, make unowned an explicit visible state rather than silent green, and give that queue a named owner of last resort.

Require that the verdict expires and re-runs on every rebuild, that it is keyed to the exact artifact and analysis that produced it, that each decision carries owner and evidence, and that high-consequence surfaces are carved out.

Establish real exposure first, then treat it as a decision that leaves engineering: isolate or move the workload if the exposure is real, otherwise accept the risk formally with a named owner, a written justification, an expiry and a review trigger — and press the vendor through the contract.

Split the problem. Replace the component in the next release so new installs are clean. Then decide separately what you owe the machines you cannot reach: a customer advisory with manual steps, a costly new update path, or accepted risk with a declared end of support.