October 2024: Supply Chain Security Updates

October 2024 shifted the spotlight to software supply chain security. Beyond the usual p-line patches, Adobe refreshed client-side libraries (e.g. RequireJS) and tightened defaults that reduce exposure to injection and dependency confusion. For engineering teams, this was a month to strengthen the build-and-release machinery that underpins every store.

Dependencies: pin Composer and NPM versions, verify checksums and restrict registries to trusted sources. Use lockfiles consistently and avoid automatic minor updates in production pipelines. Where feasible, mirror third-party packages to an internal registry to reduce exposure to upstream tampering.

CI/CD hygiene: rotate runner credentials, remove build-time secrets from images, and isolate runners per environment. Adopt OIDC federation so pipelines request short-lived credentials rather than storing tokens. Require code reviews on protected branches and enforce signed tags/releases for production deploys.

SBOMs and scanning: generate an SBOM for each release and keep it alongside build artifacts. Run SCA and container scans on every build, fail on critical findings and track remediation SLAs. For front-end assets, enable subresource integrity where applicable and align CSP with any library upgrades.

Vendor access: reduce third-party blast radius with tenancy boundaries and least privilege. Time-box any temporary support access and audit logs after sessions. For cloud environments, review WAF rules, egress controls and service allowlists after image updates.

Practical steps:

• Generate and track SBOMs per release; scan dependencies and images continuously.
• Pin Composer/NPM dependencies; restrict registries; verify checksums and signatures.
• Harden CI runners: rotate credentials, adopt OIDC, remove embedded secrets.
• Enforce reviews and signed releases on protected branches; enable SRI for front-end assets.
• Segment environments and restrict vendor access; audit sessions and rotate keys.

Done consistently, these measures reduce third-party risk and make incident response faster and more predictable.