Modern sites import a graph of packages that can change silently between builds. Teams often run a linter and ship—then learn about a critical advisory from a customer or a scanner weeks later.
Treat dependency risk like product risk: block merges on high-severity advisories with known exploits, require lockfile reviews for major bumps, and pin internal packages. Add SBOM export per release so security can trace what shipped—not what developers think shipped.
Pair automation with ownership. Name a default maintainer for third-party upgrades, document allowed exceptions, and expire them. Short, opinionated policy beats a perfect zero-trust diagram that nobody follows.