Third-party code is most of your application.
THE PRINCIPLE
Every dependency is code you did not write, running with your application's privileges, that you are responsible for keeping updated.
LOCK FILES
Commit the lock file. It records exact versions, so every environment installs the same thing.
Install from the lock file on production. Updating on production installs untested versions.
UPDATING
Update deliberately, locally, then test, then commit the updated lock file and deploy.
Do not update on production and hope.
AUDITING
Both Composer and npm provide audit commands reporting known vulnerabilities in your dependencies. Run them periodically.
A dependency with a known vulnerability is exactly how applications are compromised.
REDUCING DEPENDENCIES
Each one is a maintenance obligation and an attack surface. A package pulled in for one small function may not be worth it.
Review periodically and remove what you no longer use.
ABANDONED PACKAGES
A dependency no longer maintained receives no security fixes. Identify these and plan replacements before they become urgent.
