# pgAdmin implements dependency pinning to secure build supply chain

> **Key takeaway:** pgAdmin has introduced SHA-256 checksum verification and immutable dependency releases to prevent supply chain attacks and ensure reproducible builds.

**Published:** 2026-10-16T11:57:03+00:00 
**Source:** Planet PostgreSQL 
**Category:** databases-storage 
**Canonical URL:** https://fosswire.org/news/pgadmin-implements-dependency-pinning-to-secure-build-supply.html 

## Summary
The pgAdmin project has overhauled its build process by addressing vulnerabilities in its dependency management. By moving from mutable tags to immutable releases and implementing SHA-256 lock files, the project now ensures that the libraries included in Windows and macOS installers are exactly what the developers intended, improving both security and build reproducibility.

## Securing the pgbuild and pgAdmin pipeline
- **pgbuild** now publishes immutable releases for each upstream version alongside rolling '-latest' tags.
- **pgAdmin** uses a new lock file containing the **SHA-256** digest of every consumed archive.
- The build process now verifies downloads against these digests; a mismatch triggers an immediate build failure.
- Dependency updates now require a two-step process: rebuilding in **pgbuild** and then updating the lock file in **pgAdmin** to create a reviewable audit trail.
- The system distinguishes between security mismatches (which fail the build) and out-of-date dependencies (which only emit warnings).

## Why it matters
This change provides a standardized, verifiable reference build for PostgreSQL dependencies on Windows and macOS, benefiting other projects that ship PostgreSQL clients.