:quality(75))
October 2024 put the spotlight on software supply chain security. Alongside the usual p-line patches, Adobe refreshed client-side libraries — RequireJS among them — and tightened defaults that reduce exposure to injection and dependency confusion. The work for engineering teams was not in the store. It was in the machinery that builds and ships it.
Dependencies
Pin your Composer and NPM versions, verify checksums, and restrict registries to sources you trust. Use lockfiles consistently, and keep automatic minor updates out of production pipelines. Where it is feasible, mirror third-party packages to an internal registry so upstream tampering does not reach you directly.
The pipeline
Rotate runner credentials, strip build-time secrets out of images, and isolate runners per environment. Adopt OIDC federation so pipelines request short-lived credentials rather than storing tokens. Require code review on protected branches, and enforce signed tags and releases for production deploys.
Knowing what you shipped
Generate an SBOM for each release and keep it alongside the build artifacts. Run SCA and container scans on every build, fail the build on critical findings, and hold yourself to a remediation SLA. On the front end, enable subresource integrity where it applies, and re-check your CSP after any library upgrade — that is the step people skip, and it is the one that breaks quietly.
Third parties
Reduce the blast radius of anyone who is not you: tenancy boundaries, least privilege, time-boxed support access, and an audit of the logs after each session. In cloud environments, review WAF rules, egress controls and service allowlists once images have been updated.
The short version
Generate and track SBOMs per release; scan dependencies and images continuously.
Pin Composer and NPM dependencies; restrict registries; verify checksums and signatures.
Harden CI runners: rotate credentials, adopt OIDC, remove embedded secrets.
Enforce reviews and signed releases on protected branches; enable SRI for front-end assets.
Segment environments and restrict vendor access; audit sessions and rotate keys.
Done once, this is a project. Done consistently, it is what keeps third-party risk small and makes incident response predictable when something does land.