Dependency pinning


Topic history | v1 (current) | created by jjones

Details

Dependency pinning

| created by jjones | Add resource "Should you Pin your JavaScript Dependencies?"
Title
Dependency pinning
Description
The practice of “pinning dependencies” refers to making explicit the versions of software your application depends on (defining the dependencies of new software libraries is outside the scope of this document). Dependency pinning takes different forms in different frameworks, but the high-level idea is to “freeze” dependencies so that deployments are repeatable. Without this, we run the risk of executing different software whenever servers are restaged, a new team-member joins the project, or between development and production environments. In addition to repeatability, pinning dependencies allows automatic notification of vulnerable dependencies via static analysis. As such, all deployed applications should be pinning their library (and where possible: language, OS, etc.) versions.
Link
https://before-you-ship.18f.gov/infrastructure/pinning-dependencies/

authors

This topic has no history of related authors.

topics