Third Party Dependencies Standards · SEC-04
This document contains standards for consuming third-party libraries and other external dependencies.
Due diligence must be performed before introducing a new third-party dependency · SEC-04.1 · MUST · DEV/TEST
The due diligence must, at a minimum, cover the following questions (with an aim to answer “Yes” to every question):
- Is the dependency stable, popular, etc. (using metrics like GitHub stars and downloads)?
- Is the dependency actively maintained (using metrics like number of contributors and last update)?
- Is the latest version secure (i.e. no unpatched vulnerabilities)?
- Is the dependency solving a well-scoped, common problem (e.g. Excel integration or date parsing)?
- Does the cost to build outweigh the risk of importing?
- Is the dependency solving a non-trivial problem or one that likely to evolve in future (i.e. it would be harder to write our own code)?
- Is the license acceptable for our intended use (e.g. copyleft licenses are generally to be avoided)?