Which practice best supports secure dependency management?

• A. Use dynamic, unconstrained versioning
• B. Do not track licenses or advisories
• C. Use explicit versioning, regularly update, and track licenses and security advisories
• D. Avoid updating dependencies to maintain stability

Answer: (C)

Secure dependency management hinges on knowing exactly what goes into your software and keeping that stuff up to date and compliant. Using explicit versioning pins dependencies to fixed, known-good lines of code, which prevents drift where unexpected newer, potentially vulnerable or incompatible releases sneak in. Regularly updating dependencies brings in security patches and bug fixes, so your build isn’t exposed to known flaws. Tracking licenses helps you stay compliant with terms and avoid risky or incompatible licenses, while tracking security advisories lets you respond quickly when a vulnerability is disclosed in a library you rely on. Taken together, these practices give you reproducible builds, faster remediation, and better risk visibility for both security and licensing.

Dynamic, unconstrained versioning can introduce surprise changes and new vulnerabilities; not tracking licenses or advisories leaves you blind to compliance and security risks; avoiding updates means known flaws remain exploitable.