Unpinned / floating version in deps
Part of the Dependency supply chain check · fix arrives as a pull request
What it is
Dependencies are declared with unbounded ranges — *, latest, an open-ended >=, a bare major, or ^ on a 0.x package — where the lockfile is the only thing pinning what installs.
Why it matters
Any upstream release becomes an unreviewed change to your build. Most of the time that is a patch; occasionally it is a compromised release, and the window between publication and discovery is when your CI installs it.
How to fix it
Keep the lockfile authoritative and let a bot propose upgrades as reviewable pull requests. For anything security-critical, pin the exact version and upgrade deliberately.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.