A dependency timeline is the ordered record of when a software dependency was published, installed, or updated in a system. It can include package release timestamps, lockfile changes, build events, and deployment logs. In cyber security, this timeline helps determine which version was present at a given moment and whether a suspicious package could actually have affected a system.
It matters because attackers and defenders both rely on timing evidence. In supply-chain attacks, a malicious package may be blamed simply because it is the newest visible artifact, even when exposure began earlier through another dependency or build step. Security teams use dependency timelines to reconstruct exposure windows, verify package provenance, compare against telemetry, and avoid false attribution. A clean timeline can show whether a system installed a safe version, pulled in a compromised transitive dependency, or updated after the initial compromise.