T08 · Insecure Dependencies
Warning
- Location
README.md:111- Finding
Unpinned Remote Repository and Dependency Installation
- Content
View full analysis
- Remediation
View remediation
``` 2. Include the actual dependency manifest in the distributed and audited artifact. Remove the installation command if the project has no external Python dependencies. 3. Pin every direct and transitive dependency to an exact version and cryptographic hash. Install with hash enforcement: ```bash python -m pip install --require-hashes -r requirements.txt ``` 4. Generate a lock file using a reproducible dependency-management process and review all dependency changes before release. 5. Use the official Python Package Index through an explicitly configured index, and disable unexpected supplemental indexes to reduce dependency-confusion risk. 6. Recommend installation in an isolated virtual environment under a non-privileged account: ```bash python -m venv .venv . .venv/bin/activate python -m pip install --require-hashes -r requirements.txt ``` 7. Publish release checksums or signed provenance and instruct users to verify them before installation. 8. Add automated dependency scanning and repository-protection controls, including protected release tags, mandatory review, signed commits or releases, and maintainer multi-factor authentication. ]]>