Consider how dependency risk could be look into

[Ryan-Andrews99]

What:

Each repo contains dependencies with versions which require regular updating for security fixes

Why:

This could allow for an overview of any security risks relating to dependencies to be tracked, outside of services like dependabot etc

How (ACs/ Tech notes):

AC:

When:

A repo has an out of date dependency (missing a critical security patch)

I:

am able to see this highlighted in the web app

And: ...

When:

A repo has an dependency that is up to date/ has no known security patches to be applied

I:

There is no false positive warning

And: ...

Notes:

The big undecided thing with this ticket is how dependency risk is calculated/ retrieved. ie when do we know when to flag a risk? Could this involve the use of something external?