Incident Overview
A platform team maintains a shared CI/CD pipeline used by several internal services. Three days ago, a critical vulnerability in a widely used dependency was patched, the lockfile was updated, and the change was merged to the main branch.
Today, a routine vulnerability scan against a freshly built artefact from main still flags the old, vulnerable dependency version, even though the pipeline reports a fully green run with a successful cache restore step.
Investigation Options
Review the available operational moves and select the best immediate action.
Manually invalidate the affected cache entries and force a clean dependency install on the next pipeline run for the main branch.
Revert the dependency patch commit on main so its state matches what the cache currently restores.
Introduce a mandatory manual review step where an engineer confirms the installed dependency version before every deployment from main.
Disable caching for all pipelines across the organisation until the caching strategy can be redesigned.