--- title: The Fragmented World of Dependency Policy | daily.dev description: Every tool that makes automated decisions about dependencies has invented its own policy format. After surveying ~40 tools (cargo-deny, Snyk, Trivy, Grype,... canonical: https://daily.dev/posts/the-fragmented-world-of-dependency-policy-hsnas0afz twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: The Fragmented World of Dependency Policy | daily.dev og:description: Every tool that makes automated decisions about dependencies has invented its own policy format. After surveying ~40 tools (cargo-deny, Snyk, Trivy, Grype,... og:url: https://daily.dev/posts/the-fragmented-world-of-dependency-policy-hsnas0afz og:image: https://api.daily.dev/og/posts/hSnas0aFz.png og:image:alt: The Fragmented World of Dependency Policy og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # The Fragmented World of Dependency Policy **[Andrew Nesbitt](https://daily.dev/sources/nesbitt-io)** · 9 min read · 0 upvotes · 0 comments ## Summary Every tool that makes automated decisions about dependencies has invented its own policy format. After surveying ~40 tools (cargo-deny, Snyk, Trivy, Grype, OSV-Scanner, LicenseFinder, and more), the author finds a chaotic landscape spanning TOML, YAML in ten different schemas, XML, JSON, Rego, Kotlin scripts, and proprietary web UIs — all expressing the same concepts (license allowlists, CVE ignores, package bans) in incompatible ways. While standards like PURL, CycloneDX, SPDX, and OSV exist for describing software components, there is no standard for writing rules about them. The EU Cyber Resilience Act increases the urgency of this gap. The author outlines what a unified dependency policy standard might cover — license rules, vulnerability ignores with expiry dates, package bans, severity thresholds, and scoping — and calls for collaboration to design one rather than adding yet another proprietary format. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Managing dependency risk and transitive dependencies](https://daily.dev/posts/managing-dependency-risk-and-transitive-dependencies-thwqzzca5) · Security Boulevard · 0 upvotes · 0 comments - [The Dependency Dilemma: Balancing Innovation Speed with Supply Chain Resilience](https://daily.dev/posts/the-dependency-dilemma-balancing-innovation-speed-with-supply-chain-resilience-iw1sarfuo) · JFrog · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#sbom](https://daily.dev/tags/sbom) [View this post on daily.dev](https://daily.dev/posts/the-fragmented-world-of-dependency-policy-hsnas0afz) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"The Fragmented World of Dependency Policy","url":"https://daily.dev/posts/the-fragmented-world-of-dependency-policy-hsnas0afz","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/the-fragmented-world-of-dependency-policy-hsnas0afz"},"datePublished":"2026-03-31T12:41:48.417Z","dateModified":"2026-03-31T12:58:54.366Z","description":"Every tool that makes automated decisions about dependencies has invented its own policy format. After surveying ~40 tools (cargo-deny, Snyk, Trivy, Grype,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/416572ca2b211e96c4c4b92af22d1ec7?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/416572ca2b211e96c4c4b92af22d1ec7?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Andrew Nesbitt","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Andrew Nesbitt","logo":"https://media.daily.dev/image/upload/logos/placeholder.jpg","url":"https://daily.dev/sources/nesbitt-io"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/the-fragmented-world-of-dependency-policy-hsnas0afz","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,sbom","timeRequired":"PT9M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Andrew Nesbitt","item":"https://daily.dev/sources/nesbitt-io"},{"@type":"ListItem","position":3,"name":"The Fragmented World of Dependency Policy"}]} ```