# Dependency range is floating

A dependencies, devDependencies, or optionalDependencies value that is exactly * or latest.

Area: Security

## What you need to supply

A package.json with a top-level name plus dependencies, devDependencies, or scripts.

## If it reports a finding

Medium severity. The suggested next step is to pin the dependency to a reviewed version.

## What this does not prove

^1.2.3, ~1.2.3, and a pinned version are not this finding.

## Range that this check is written to notice

```
{
  "name": "demo",
  "dependencies": {
    "left-pad": "*"
  }
}
```

Reading this page does not submit infrastructure. The HTML page is https://skaleagents.com/checks/dependency-range-is-floating.