Security in the dependency supply chain

Every `npm install` pulls a huge tree of trust. Without a versioned lockfile, builds aren't reproducible and vulnerabilities enter without an audit trail.

Automate scanning (SCA) in CI, but don't let mass false positives hide signal — tune policy (severity, licenses) to keep the channel useful. Patch updates should be routine; majors need changelog and tests.

An SBOM shipped with releases helps regulated clients and speeds CVE response. Combined with artifact signing, you reduce risk of malicious substitution in the pipeline.

Culture matters: no one should feel that «asking time to review a dependency» is a blocker — it's part of engineering craft.