Dependency pinning

Topic | v1 | created by jjones |

The practice of “pinning dependencies” refers to making explicit the versions of software your application depends on (defining the dependencies of new software libraries is outside the scope of this document). Dependency pinning takes different forms in different frameworks, but the high-level idea is to “freeze” dependencies so that deployments are repeatable. Without this, we run the risk of executing different software whenever servers are restaged, a new team-member joins the project, or between development and production environments. In addition to repeatability, pinning dependencies allows automatic notification of vulnerable dependencies via static analysis. As such, all deployed applications should be pinning their library (and where possible: language, OS, etc.) versions.


subtopic of Computer programming

Computer programming is the process of designing and building an executable computer program to accom...

Edit details Edit relations Attach new author Attach new topic Attach new resource

treated in Should you Pin your JavaScript Dependencies?

7.0 rating 5.0 level 8.0 clarity 3.0 background – 1 rating

The pros and cons of dependency pinning for JavaScript/npm