Description

Dependencies are not explicitly declared (name and version) within the source code. They are copied directly into the repositories.

Impact

- Loss of maintainability because dependencies are not maintained. - Late update of units in case a vulnerability is reported for one of the reported vulnerabilities.

Recommendation

All dependencies must be declared and must referenced with a dependency manager (npm, pip, maven). This allows to standardize projects construction and packaging.

Threat

Authenticated attacker from the Internet.

Expected Remediation Time

⏱️ 120 minutes.

Requirements

Fixes