An open-source dependency is a third-party library or package that an application uses instead of building the function itself. These components save development time, but they also import their own code, maintenance history, and security weaknesses. If the dependency is outdated or misconfigured, the application can inherit known vulnerabilities without any change to its own source code.
In cyber security, open-source dependencies matter because attackers often target the software supply chain rather than the main application. A flaw may exist in a direct package or in a transitive dependency several layers deep. Defenders use software composition analysis, dependency graphs, and SBOMs to inventory what is installed, identify risky versions, and prioritize patches. Good defense also requires testing fixes, because updating a library can break builds or alter behavior.