T08 · Insecure Dependencies
Warning
- Location
SKILL.md:37- Finding
Unpinned Third-Party Dependencies Permit Supply-Chain Substitution
- Content
View full analysis
- Remediation
View remediation
pydub== ``` 2. Generate and enforce cryptographic hashes for every direct and transitive package: ```bash pip install --require-hashes -r requirements.txt ``` 3. Use a locking workflow such as `pip-tools` to resolve transitive dependencies reproducibly: ```bash pip-compile --generate-hashes requirements.in ``` 4. Replace all unpinned installation examples with: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 5. Prefer the official Python Package Index or an organization-controlled, synchronized repository. If a third-party mirror is required, document its trust assumptions and retain hash verification. 6. Review dependency release provenance and vulnerability advisories before updating locked versions. Apply updates through an explicit review process rather than allowing automatic resolution to the latest release. 7. Install dependencies in an isolated virtual environment under a non-privileged account. Do not run `pip` as `root`. 8. Ensure `config.json` records exact reviewed versions rather than bare package names, or designate the hashed lock file as the authoritative dependency manifest. ]]>