A dependency vulnerability is a security flaw in a third-party library or package your own code relies on — not a bug in your own code, but one you inherit by using that dependency.
Why they’re so common
- Modern applications often pull in hundreds of indirect (transitive) dependencies beyond what a developer directly chose
- A vulnerability in one widely-used low-level package can affect a huge number of downstream applications simultaneously
- Dependencies are frequently added once and rarely revisited unless something breaks
Managing the risk
- Run automated dependency audits (e.g.
composer audit,npm audit) as a routine, scheduled check — not a one-time exercise - Keep dependencies reasonably current rather than pinning versions indefinitely
- Minimize dependency count where practical — fewer dependencies is directly less exposure
FAQ
Am I responsible for vulnerabilities in code I didn’t write?
Practically, yes — if it runs in your application, it’s part of your attack surface regardless of who authored the original code.