Security Tip: A Dependency Update Evidence Checklist
A short checklist for proving a dependency security update reached the running application.
Do not close a security ticket with “composer update” or “bundle update” alone. Record the evidence that connects the advisory to the running service.
- Advisory and affected package recorded.
- Lock-file diff reviewed.
- Regression or security test added or run.
- Fresh build completed without cache reuse.
- Exact commit or image digest promoted.
- Post-release health and log checks passed.
This works for Ruby gems, PHP packages, Laravel components and container images. The format is small enough for a ticket and strong enough for an incident review.
Operator footer. Applies to every third-party dependency. Keep the evidence with the change record; stop if the production artifact cannot be identified. Related reading: software supply-chain and advisory-response posts.
