Supply chain dependency reviews
Make the dependency diff part of the change review
Capture resolved packages and execution changes before building the release. Keep exceptions and artifact evidence connected to the same review.
In this article
Produce a reviewable inventory
Generate a dependency inventory from the resolved build inputs, including transitive packages. Store the package-manager and runtime versions needed to reproduce the installation.
Compare the inventory and lockfile with the approved baseline. Highlight newly introduced packages, source changes and installation behaviour that deserves attention.
This synthetic review record shows the decisions to capture. It is not a standard SBOM or provenance format.
{
"changeId": "dependency-example-19",
"package": "example-document-parser",
"executionStages": ["build", "runtime"],
"newTransitivePackages": 2,
"reviewOwner": "application-maintainers",
"behaviourTests": ["malformed-file", "existing-document-fixtures"],
"exception": null
}Run installation under limited authority
Use the package manager's supported reproducible installation mode and the project's committed configuration. Fail on unexpected manifest-lockfile disagreement.
Keep unnecessary production credentials out of install and test jobs. Review script execution policy and verify which scripts the required packages need. Disabling scripts indiscriminately can break a build, while allowing all scripts without review expands its reach.
Use isolated build environments and controlled artifact promotion so a test job does not also carry broad deployment authority by default.
Connect automated findings to human decisions
Run supported advisory and dependency-review tooling, then inspect relevant changes and release notes. Record false positives or accepted exceptions with scope and a revisit condition.
Choose behaviour tests from the dependency's role. An updated HTTP client should preserve timeout, redirect and error handling used by the application. A general green unit suite may never exercise those boundaries.
Preserve the release evidence
Associate the final artifact digest with source revision, dependency inventory and available provenance. Verify the expected builder and inputs before promotion where the platform supports that control.
Retain a known approved rollback artifact. Test the release in a bounded environment and confirm that the deployed artifact is the reviewed one rather than a separate untracked rebuild.
Primary sources
GitHub: dependency reviewnpm: clean installSLSA: provenanceReferences checked 11 September 2026.