Dependencies
The platform relies on third-party libraries, as any substantial application does.
Where to find it
Architect Panel → Activity:
- Error Log — where a dependency problem usually surfaces
Architect Panel → Configuration:
- Site Settings — the platform version in use
Why this is your concern
You did not choose these libraries and you are running them. A vulnerability in one is a vulnerability in your installation, and "we use a platform" is not an answer anybody accepts on a security questionnaire.
Know what you are running
Be able to say which platform version you are on and when it was last updated. That single fact answers most dependency questions, because platform updates carry library updates with them.
An installation nobody can date is an installation nobody can assess.
Staying current is the strategy
Rather than tracking individual libraries. The realistic approach for most organisations is to take platform updates on a regular cadence, which brings dependency updates as part of the package.
An installation two years behind is not two years of missing features — it is two years of unapplied fixes, some of them security fixes.
Old is the risk, not new
The instinct is that updating is risky and staying put is safe. The reverse is true over any meaningful period: an update might break something you can test for and fix, and a known vulnerability in an old library is being actively looked for.
Watch what you add yourself
Anything you introduce — a library used by an extension, a script, a vendored component — is yours to track. The platform's update cadence does not cover it, and it will be forgotten precisely because nobody chose it deliberately.
Keep a note of what you have added and where it came from.
Client-side libraries too
Anything vendored into the front end is delivered to your users' browsers. Old client-side libraries are a real attack surface and are easy to overlook because they are not on the server.
Have somebody responsible
"Keeping the platform current" needs an owner, or it is nobody's job and it does not happen. It is a small recurring task and an enormous one-off task if left.
Worked example
An organisation takes platform updates quarterly, records the version and date after each, and keeps a short list of the two libraries its extensions use. When a security questionnaire asked what it ran and how it stayed current, the answer took ten minutes rather than a week.
Recommendations
- Know your version and update date.
- Take updates on a cadence rather than when forced.
- Track anything you added yourself.
- Give it an owner.