# Know what your software brings with it.

Dependency & supply chain reviews

Track vulnerable packages, build provenance and upgrade risk across the delivery lifecycle.

## Know what enters the build

Illustrative workflow.

- Dependency inventory: Direct packages and transitive components
- Build provenance: Source, versions and artifact traceability
- Upgrade path: A reviewed change with regression checks



## A dependency is an operating responsibility

Inspect package exposure, maintenance status, build inputs and update practices. Prioritise the components that can affect important data or execution paths, not just the longest advisory list.

Illustrative scenario, not a customer case study.

A software team needs to maintain third-party packages without introducing avoidable release risk.

Inventory direct and transitive dependencies, review advisories in context and test the affected runtime paths after updates. Record exceptions with an owner and review date.

Verification: Track exposed unresolved issues and verify upgrade behaviour in representative workflows.

## What needs attention in your system?

Select the areas you want to discuss. The HTML page can download your selections.

- [ ] Dependency inventory: Identify direct and transitive packages, their versions and how they reach production.
- [ ] Exposure assessment: Assess findings against actual application usage and deployment conditions.
- [ ] Controlled upgrades: Review compatibility, build provenance and regression evidence before releasing dependency changes.

## Know the components inside the artifact.

### Dependency inventory

Identify direct and transitive packages, their versions and how they reach production.

### Exposure assessment

Assess findings against actual application usage and deployment conditions.

### Controlled upgrades

Review compatibility, build provenance and regression evidence before releasing dependency changes.

## What your team receives

Included scope agreed before delivery.

- Dependency inventory: Direct and transitive packages with relevant exposure context.
- Remediation plan: Prioritised fixes, mitigations and accepted exceptions.
- Build evidence: Versioned inputs and verification of the resulting artifact.

## Should every advisory block a release?

Review severity, reachability, available mitigations and the affected workload. Document an accountable decision instead of silently ignoring the finding.