Third-party dependency advisories drive time-bounded upgrade or exception records with owner approval, compensating controls, and CI enforcement so known-critical CVEs cannot ship silently while legitimate exceptions remain auditable and expiring.
Package status: AI-assisted reference package. Static package validation has passed; implementation scenarios remain not run and human domain review is required before stable adoption.
Decision
Dependency advisories from the profile scanner feed merge-blocking checks keyed on severity thresholds. Exceptions bind to exact lockfile_path, sbom_component_id, and component_digest so CI can verify the waiver covers the scanned finding and not a different install path or version. Exceptions require owner approval, compensating control description, and hard expiry.
Scope
- Advisory ingestion, severity thresholds, upgrade SLAs, exception records, CI binding verification, and SBOM or lockfile correlation.
Outside this block
- Container base image patching owned by platform teams unless explicitly in scope for the repo profile.
- License compliance scanning unrelated to security advisories.
- Runtime intrusion detection and WAF rule tuning.
Contract
- Critical-severity advisories with public exploit signals block release builds within critical_sla_hours unless a valid non-expired exception covers the exact cve_id, lockfile_path, sbom_component_id, and component_digest.
- Exception records include all exception_bind_fields; missing fields reject registry commit.
- ci_verifies_exception_binding compares scanner output to exception binding fields on every release build.
- Expired exceptions fail CI immediately without grace extension unless a new approval record replaces them before expiry.
- Upgrade merges must reduce advisory count for the targeted package; re-scan after merge proves the CVE no longer applies or remains excepted explicitly.
- Transitive vulnerabilities inherit the same SLA unless waived with exception tied to the lockfile path entry.
- Scanner false positives require vendor advisory id or NVD reference in the dispute record before suppression.
- Exception count per repository has a profile cap; exceeding cap fails policy review gate.
Implementation guidance
- Pin scanner version and advisory database freshness timestamp in CI logs.
- Store exception-record.yaml entries in a dedicated registry directory reviewed by security owners.
- Integrate OWASP Dependency-Check or equivalent primary tooling configured for the ecosystem; document scanner choice in the profile.
- Notify owners at half-life of exception expiry when owner_notification_half_life is true.
Failure handling and safeguards
- Scanner outage fails closed for release branches when release_branch_blocking is true; develop branches may warn-only per develop_branch_warn_only.
- Emergency break-glass exception requires secondary approver and auto-expiry within seven days unless profile specifies shorter.
- Removing a dependency without upgrading must still clear advisory findings tied to lockfile entries.
Verification and operations
- CI fixtures include a known CVE coordinate and a mismatched sbom_component_id to prove blocking and binding enforcement paths.
- Metrics track open exceptions by age, SLA breaches, and mean time to remediate.
- Monthly audit samples exception compensating controls for plausibility, not legal certification.
Adoption assumptions
- Names and numeric values in example.yaml and exception-record.yaml are an adoption profile, not universal defaults.
- The adopting team selects scanner tooling, severity mapping, and owner roster.