Open Source Dependency Audit Template

Run a full audit quarterly and a lighter security-focused scan on every pull request. Automated tools (Snyk, Dependabot) handle the continuous scanning. The quarterly audit covers license compliance, dependency health, and SBOM updates that automated tools miss. Also trigger an audit before compliance certifications (SOC 2, ISO 27001) and before entering regulated markets.

GPL requires that derivative works be distributed under the same GPL license. If you statically link a GPL library into your proprietary application, your application may be considered a derivative work, which means you would need to open-source it. The risk depends on how the library is integrated (static linking vs. dynamic linking vs. separate process). LGPL is more permissive and generally allows dynamic linking without triggering the copyleft requirement. Always get legal review for GPL usage in commercial products.

A Software Bill of Materials (SBOM) is a complete list of all software components in your product, including versions and licenses. Enterprise customers request SBOMs for their own security and compliance programs. US Executive Order 14028 (2021) requires SBOMs for software sold to federal agencies. Generate SBOMs in standard formats: SPDX or CycloneDX. Use tools like `syft`, `cdxgen`, or `@cyclonedx/bom` to automate generation as part of your [release management](/glossary/release-management) process.

First, assess whether the vulnerability is exploitable in your specific usage. Many CVEs apply only to specific configurations or features of a package. If exploitable: patch immediately by upgrading, applying a backport, or replacing the dependency. If no patch exists: implement a workaround (WAF rule, input validation, feature disable) while waiting for the fix. Communicate impact to customers per your incident response process. Track remediation as a P0 item in your backlog.

Most teams should use a registry with lock files rather than vendoring. Vendoring (copying dependency source code into your repo) makes updates harder and bloats the repository. However, vendor dependencies when: you need to modify the source, the upstream project is abandoned, or you operate in an air-gapped environment. If you vendor, document the original source, version, license, and your modifications. Review vendored code during quarterly audits. ---