Dependency drift is the gradual change in third-party libraries, packages, or services that software relies on. It can occur when components are updated, replaced, abandoned, or behave differently across versions, even if the application’s own code has not changed.
Drift matters because a dependency change can introduce vulnerabilities, remove security protections, or alter how an application handles data. Attackers may exploit outdated or compromised components, while defenders reduce risk by tracking dependencies, reviewing and testing updates, pinning versions where appropriate, and regularly checking for known vulnerabilities. For long-lived systems, documenting ownership and maintaining an update process helps future teams keep dependencies secure.