Document external code dependencies and include these in the packaging if possible. Correct behaviour of software usually depends on the build environment and a large number of external components. Wherever possible the development and packaging should actively prevent an insecure deployment by dependency management. However, it should be noted that overly strict and detailed dependency specification may lead to restrictions in upgradeability. For instance, it should not be required that the version number of a shared library is exactly equal to the version with a critical security bug fix, but rather, equal or greater. .
