Software supply chain security requires decisions rather than defaults

What it is

An Aikido opinion piece arguing that supply-chain safety comes from deliberate, recorded version decisions rather than reflexive upgrades. The summary covers the thesis and the xz-utils/lodash cases; what it omits is the concrete decision procedure the piece prescribes and a reachability check it treats as the deciding factor.

How it works

The core diagnostic: a team can name its open CVE count instantly, but usually can't say why a given package or container image is on its current version, and almost never has that decision written down. The article frames every point in the chain — a developer, agent, or build pipeline requesting a base image or package — as a decision to evaluate before it enters the environment, not after.

For CVE response it contrasts two moves. Upgrading pulls in everything else that shipped in the release (transitive deps, changed defaults, unread code paths). Backporting instead applies only the specific fix to the version already running — and the piece notes this works on container base images too (fix the CVE without forcing a new base image), not just packages.

What to do

• For any component, be able to answer why it's on its current version, and record that decision.
• Before upgrading to patch a CVE, check reachability: for lodash, the teams in the strongest position knew whether their app actually called the affected _.template path with untrusted input, and weighed that against the broken build — rather than blindly upgrading or downgrading.
• Prefer backporting the specific fix over jumping releases.
• Treat the SBOM as a continuously maintained baseline, checked against new disclosures as they arrive.

Caveats

The piece notes CISA's post-xz guidance was to downgrade, not upgrade — safe here only because the older 5.4.x line was never compromised, not a general rule. It also concedes some teams stay on old versions through neglect rather than judgment; the failure it targets is not knowing what you run or why.