Unpinned Dependency Versions
Overview
Using version ranges (^1.2.3, ~1.2.3, >=1.0.0, *, latest) instead of exact pinned versions means builds can install different dependency versions over time. This allows:
- Accidentally upgrading to a version with new vulnerabilities
- Installing a maliciously updated package
- Non-reproducible builds
Remediation
- Pin exact versions in production:
"express": "4.18.2"not"^4.18.2" - Use lockfiles to ensure reproducible installs
- Update dependencies deliberately with security review