Description

Detects JavaScript/Node.js dependencies that are locked to exact versions in package.json, preventing security updates. This creates security risk by forcing the application to use potentially vulnerable package versions even when patches are available.

Detection Strategy

• Review package.json files to identify dependencies with exact version constraints

• Check for version specifiers that prevent upgrades (e.g. '1.2.3' instead of '^1.2.3' or '~1.2.3')

• Report dependencies where automatic security updates are blocked by strict version pinning