> For the complete documentation index, see [llms.txt](https://engineering.umh.app/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://engineering.umh.app/engineering/development-process/how-to-build/tickets/security/dependencies.md). # Dependencies The five fields a vulnerable dependency adds to a security ticket. Owner: Jeremy [Tickets › Security](/engineering/development-process/how-to-build/tickets/security.md) says what every security ticket has to say. This page covers the fields a vulnerable dependency adds. [Security scanning](/engineering/development-process/how-to-decide-what-to-build/signals/security-scanning.md#how-a-ticket-closes) says how the upgrade arrives and how the ticket closes. ## Rules * The Package field holds the path the build file requires. * Read the shipped version from what the build resolves, not from what the build file asks for. * A clean version is the version the advisory itself names as fixed. * A package you know is affected is still affected even when the advisory database returns no records. * Decide reachability per component. ## Package **Advisory text names subpackages. A build file names modules.** The Package field holds the module. **A path that looks like a subpackage can be a module of its own**, with its own version in the build file. Read the path out of the build file rather than shortening the one the advisory names. ## Version here **For npm, the shipped version is in the lockfile.** `package.json` holds a range rather than a version. A transitive dependency is not in it at all. **For Go, `replace` directives and a `vendor/` directory set what builds.** The `require` line can name a version that never ships. ## Clean version **Read the clean version out of the advisory.** An advisory database queried at an affected version can return zero records: the query succeeded and the package is still affected. ## Reachable through **Reachability is per component.** One repository can ship a package that another only builds with. **In npm, imported is not the same as shipped.** A bundler can leave a package out of the artefact a customer downloads. A package imported only by a build or test script reaches nothing the customer runs. ## Template The dependency part of the [security ticket template](/engineering/development-process/how-to-build/tickets/security.md#template): ```markdown ## If it is a dependency **Package:** **Version here:** **Clean version:** **Dependency type:** **Other advisories in the same upgrade:** ``` --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://engineering.umh.app/engineering/development-process/how-to-build/tickets/security/dependencies.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.