Dependency Pinning.

The practice of declaring software dependencies at exact versions, often combined with cryptographic hashes, so that builds always consume the same artifacts and resist supply-chain tampering. It belongs to the Application Security category of cybersecurity.

The practice of declaring software dependencies at exact versions, often combined with cryptographic hashes, so that builds always consume the same artifacts and resist supply-chain tampering.

Dependency pinning replaces loose version ranges (e.g. "^1.0.0") with exact versions and, ideally, cryptographic digests in a lockfile (package-lock.json, poetry.lock, Pipfile.lock, Gemfile.lock, go.sum, Cargo.lock). Builds then become reproducible and resistant to silent upgrades, dependency confusion, typosquatting, and compromised package versions. Modern practice also pins GitHub Actions and other CI plugins to commit SHAs rather than mutable tags. Pinning must be paired with active vulnerability monitoring (SCA, GitHub Dependabot, Renovate) so that patches still flow in, otherwise pinned applications grow stale and accumulate CVEs. Hash-pinning is a key control referenced by SLSA, NIST SSDF, OWASP, and reproducible-builds initiatives.

Defences for Dependency Pinning typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Version pinning, Hash pinning.