---
title: "WEB-APP-008 Dependency Lock Files Older Than a Year"
canonical: https://openvapt.com/checks/WEB-APP-008.html
html: https://openvapt.com/checks/WEB-APP-008.html
site: OpenVAPT, https://openvapt.com/
license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html
modified: 2026-10-14
version: 0.1.0-alpha.6
---

# WEB-APP-008 Dependency Lock Files Older Than a Year

Reports composer.lock, package-lock.json, yarn.lock, Gemfile.lock and poetry.lock files not modified for 365 days or more (dependency freshness). Informational.

- Domain: Web Apps
- Severity: Info
- Control category: Patch and Vulnerability Management
- Fix effort: medium
- CVSS v3.1 vector: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N`
- CIS Controls v8: 7.4
- NIST CSF 2.0: ID.RA-01, PR.PS-02
- CWE: CWE-1104, CWE-1395
- OWASP Top 10 2021: A06:2021
- OWASP ASVS 4.0.3: 14.2.1
- NIST SP 800-53 Rev. 5: SI-2, SA-22

## Why It Matters

A lock file pins exact library versions. One untouched for a year means the application has had no dependency updates in that time, so every library vulnerability published since is still present. The check cannot tell whether a specific vulnerability applies; the known-vulnerability checks and composer audit or npm audit do that.

## How It Detects

Stats each lock file found in the project folders (metadata only) and reports those whose modification time is 365 days or older. Files whose time cannot be read are reported as incomplete.

## How to Fix

Run composer update / npm update / bundle update / poetry update in a test environment, run the audit command of each ecosystem (composer audit, npm audit, bundle audit, pip-audit) and deploy. Schedule dependency updates at least quarterly.

## How to Verify

```
stat -c '%y %n' composer.lock package-lock.json  shows a recent date.
```

## Learn the Theory

- [A6 Application Framework and CMS Configuration](https://openvapt.com/academy/a6.md)

## References

- [OWASP Vulnerable Dependency Management Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Vulnerable_Dependency_Management_Cheat_Sheet.html)
- [OWASP Top 10 2021, A06 Vulnerable and Outdated Components](https://owasp.org/Top10/A06_2021-Vulnerable_and_Outdated_Components/)

## Source Code

https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/frameworks.go

Run it: `openvapt scan --only WEB-APP-008`. Read it offline: `openvapt explain WEB-APP-008`.

---

OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/checks/WEB-APP-008.html. Part of OpenVAPT Check Catalogue. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.