Instruction file imported from pipoventures/surfaceplate (
.github/instructions/09-dependencies-and-supply-chain.instructions.md). Copyright stays with the author.
For agents — Dependencies and supply chain
Installed by Surfaceplate. Do not edit this file in an adopting repository.
- Use a declared, locked dependency set. Run the approved dependency review or vulnerability check on every lockfile or direct-dependency change, and record the command and result. A manifest alone is not a vulnerability assessment.
- Do not add a dependency the existing toolchain already solves the problem with. A new direct dependency on a calculation or security path is an audit trigger.
- Treat authentication/authorisation, data upload/download, export/reporting, database access, deserialisation of external input, file-path handling, subprocess/shell invocation, and requests to external systems as security-sensitive surfaces requiring explicit review.
- Never weaken an existing credential, authorisation, or permission control to make a task easier — that is always a stop-and-ask.
- Dependency exceptions and security waivers are human decisions — recommend, never grant them yourself.