SOP-10 — Dependency, vulnerability and SBOM maintenance

Owner: Owner-operator (Document Owner and Records Owner for every SOP; no delegate exists). Version 2026-10-06 · effective 2026-10-01 · reviewed every 90 days · last reviewed 2026-10-06 · next review due 2027-01-04.

Purpose

Know every component and license in the product and fix known vulnerabilities on a stated clock.

Scope

Python and JavaScript dependencies.

Procedure

Weekly automated pip-audit and yarn audit; results stored and published.
Critical/high: patch or mitigate within 7 days; medium 30 days; low next release. Unfixable findings carry a written mitigation on the scan record.
Any dependency change updates the SBOM: Python is read live from the environment; the JS license inventory (frontend/licenses.json) is regenerated with license-checker on every frontend dependency change and committed.
Strong-copyleft (GPL/AGPL/SSPL) components are not added without owner sign-off recorded in the change log; current count is zero.

Records this procedure produces — and who keeps them current

Record	Where	Updated by	Update trigger	Retention	Public
Security scan results	`db.security_scans`	system weekly	weekly	indefinite	True
SBOM	`/api/trust/sbom; frontend/licenses.json`	system / owner	dependency change	current + history in git	True

Evidence

/api/trust/sbom

Change log

Date	Change
2026-10-06	Written as SOP.

Quality Manual · All SOPs · Records Register