Third-Party Dependencies Reference
Comprehensive Catalogue of External Dependencies in Modern Web Applications
📚 Reference Purpose
This comprehensive reference documents the extensive ecosystem of third-party dependencies commonly found in modern web applications and cloud architectures. Each dependency represents a potential point of failure that can disrupt service availability.
Understanding these dependencies is crucial for assessing organizational risk exposure and designing survivable hybrid cloud architectures that maintain operational continuity during third-party service failures.
🎨 Front-End Frameworks & Libraries
Client-side dependencies loaded directly in the browser. Failure impacts user interface rendering and interactivity.
CSS Frameworks
| Library | CDN / Host | Risk Level |
|---|---|---|
| Bootstrap 5 | cdn.jsdelivr.net | Medium |
| Tailwind CSS | cdn.tailwindcss.com | Medium |
| Bulma | unpkg.com/bulma | Medium |
JavaScript Frameworks
| Library | CDN / Host | Risk Level |
|---|---|---|
| React | unpkg.com/react | High |
| Vue 3 | cdn.jsdelivr.net/npm/vue | High |
| Angular | ajax.googleapis.com | High |
| jQuery | code.jquery.com | High |
JavaScript Utilities
| Library | CDN / Host | Risk Level |
|---|---|---|
| Lodash | cdn.jsdelivr.net/npm/lodash | Medium |
| Axios | cdn.jsdelivr.net/npm/axios or unpkg.com/axios | Medium |
🔤 Fonts & Icons
Typography and iconography resources. Failure degrades visual presentation but may not break core functionality.
Web Fonts
| Library | CDN / Host | Risk Level |
|---|---|---|
| Google Fonts | fonts.googleapis.com | Low |
| Adobe Fonts | use.typekit.net | Low |
Icon Libraries
| Library | CDN / Host | Risk Level |
|---|---|---|
| Font Awesome | cdnjs.cloudflare.com | Low |
| Material Icons | fonts.googleapis.com | Low |
| Feather Icons | unpkg.com/feather-icons | Low |
📊 Data Visualization
Charting and data visualization libraries. Failure prevents rendering of dashboards, analytics, and reports.
| Library | CDN / Host | Risk Level |
|---|---|---|
| Chart.js | cdn.jsdelivr.net/npm/chart.js | Medium |
| D3.js | d3js.org | Medium |
| Plotly | cdn.plot.ly | Medium |
🔐 Authentication & CAPTCHA
Identity verification and bot protection services. Failure prevents user login and can lock out legitimate users.
| Service | Host | Risk Level |
|---|---|---|
| Google reCAPTCHA | google.com/recaptcha | Critical |
| hCaptcha | hcaptcha.com | Critical |
| Cloudflare Turnstile | challenges.cloudflare.com | Critical |
| Google Sign-In | accounts.google.com | Critical |
| GitHub OAuth | github.com/login/oauth | Critical |
| Auth0 | cdn.auth0.com | Critical |
✓ Form Validation
Client-side validation libraries. Failure may allow invalid data submission or prevent form submission entirely.
| Library | CDN / Host | Risk Level |
|---|---|---|
| Parsley.js | cdn.jsdelivr.net | Medium |
| Validator.js | unpkg.com/validator | Medium |
| Yup | unpkg.com/yup | Medium |
🔄 APIs & State Management
Data fetching and application state management. Failure prevents data synchronization and API communication.
| Library | CDN / Host | Risk Level |
|---|---|---|
| Apollo Client | unpkg.com/@apollo/client | High |
| Fetch Polyfills | Various JS CDNs | Medium |
☁️ Backend & Cloud Integrations
Backend-as-a-Service platforms. Failure impacts database access, file storage, and core application functionality.
| Service | CDN / Host | Risk Level |
|---|---|---|
| Firebase | gstatic.com/firebasejs | Critical |
| Supabase | cdn.jsdelivr.net/npm/@supabase | Critical |
| AWS Amplify | unpkg.com/aws-amplify | Critical |
⚡ Realtime & Messaging
WebSocket and realtime communication services. Failure breaks live updates, chat, and collaborative features.
| Service | CDN / Host | Risk Level |
|---|---|---|
| Socket.io | cdn.socket.io | High |
| Pusher | js.pusher.com | High |
| Ably | cdn.ably.com | High |
📈 Analytics & Tracking
Usage analytics and tracking services. Failure prevents data collection but typically doesn't affect core functionality.
| Service | CDN / Host | Risk Level |
|---|---|---|
| Google Analytics / Tag Manager | googletagmanager.com | Medium |
| Mixpanel | cdn.mxpnl.com | Medium |
| Plausible Analytics | plausible.io/js/script.js | Low |
💬 Customer Engagement & CRM
Customer support and engagement widgets. Failure prevents customer communication but doesn't break core application.
| Service | CDN / Host | Risk Level |
|---|---|---|
| Intercom | widget.intercom.io | Medium |
| Crisp.chat | client.crisp.chat | Medium |
| Zendesk | static.zdassets.com | Medium |
| Mailchimp | list-manage.com | Medium |
| HubSpot Forms | js.hsforms.net | Medium |
| Typeform | embed.typeform.com | Medium |
🐛 Error Monitoring & APM
Application performance monitoring and error tracking. Failure blinds operations to production issues.
| Service | CDN / Host | Risk Level |
|---|---|---|
| Sentry | browser.sentry-cdn.com | High |
| Rollbar | cdn.rollbar.com | High |
| New Relic Browser Agent | js-agent.newrelic.com | High |
💳 Payments & E-Commerce
Payment processing integrations. Failure prevents transactions and directly impacts revenue.
| Service | CDN / Host | Risk Level |
|---|---|---|
| Stripe.js | js.stripe.com | Critical |
| PayPal SDK | paypal.com/sdk/js | Critical |
| Square Payments | js.squareup.com | Critical |
| Snipcart | cdn.snipcart.com | Critical |
| Shopify Buy Button SDK | sdks.shopifycdn.com | Critical |
| Paddle | cdn.paddle.com | Critical |
🏗️ Infrastructure Layer (IaaS/PaaS)
Core compute, storage, networking — the foundation layer. Failure cascades to all dependent services and applications.
Public Cloud IaaS/PaaS
| Category | Major Providers | Dependencies |
|---|---|---|
| Public Cloud IaaS/PaaS | AWS, Microsoft Azure, Google Cloud Platform, IBM Cloud, Oracle Cloud Infrastructure | Global networking, DNS, power, Internet peering providers (Equinix, Level3, etc.) |
| CDN/Edge Compute | Cloudflare, Fastly, Akamai, CloudFront, Azure Front Door, Google Cloud CDN, StackPath | Regional POPs, ISPs, TLS CAs, DNS resolvers |
| Object Storage | AWS S3, Google Cloud Storage, Azure Blob Storage, Backblaze B2, Wasabi | Data center storage infrastructure and upstream network |
🔧 SaaS Foundations
Critical building blocks used by SaaS apps. Failure creates cascading impact across multiple dependent platforms.
| Function | Examples | Impact |
|---|---|---|
| Authentication / IAM | Okta, Auth0, Microsoft Entra ID, Ping Identity | Impacts login to multiple enterprise SaaS platforms |
| Payment Processing | Stripe, PayPal/Braintree, Adyen, Square, Worldpay | Payment gateway/API connectivity; backend bank networks |
| Email / Messaging | SendGrid (Twilio), Mailgun, Amazon SES, Postmark, Mandrill | Impacts transactional or marketing email pipelines |
| Data / API Integration | MuleSoft, Zapier, Workato, Segment, Tray.io, Fivetran | Connects multiple SaaS and cloud APIs—multi-system impact |
| Monitoring / Observability | Datadog, New Relic, Dynatrace, Splunk Observability, Elastic Cloud | Essential for incident detection; outage may blind operations |
| CI/CD / Developer Tools | GitHub, GitLab, Bitbucket Cloud, CircleCI, Jenkins Cloud, GitHub Actions, Travis CI | Impacts development lifecycle, deployments |
| Container / K8s Management | EKS (AWS), AKS (Azure), GKE (Google), OpenShift Cloud, Rancher | Core ops infrastructure |
| Collaboration / Productivity | Microsoft 365, Google Workspace, Slack, Zoom, Atlassian Cloud, Dropbox, Box | Key internal communications and doc management |
| CRM / ERP / HR | Salesforce, ServiceNow, Workday, Netsuite, SAP S/4HANA Cloud, HubSpot | Vital enterprise SaaS layers |
| DNS / Domain / Certificates | Cloudflare DNS, AWS Route53, Google Cloud DNS, Akamai Edge DNS, GoDaddy, Let's Encrypt, DigiCert | DNS resolution or certificate failures can disable entire services |
🌐 Backend Internet Foundations
Even beyond SaaS providers, outages can propagate if these backbone services fail. These represent single points of failure for internet-scale infrastructure.
| Layer | Examples | Impact |
|---|---|---|
| DNS / Anycast Resolvers | Google Public DNS (8.8.8.8), Cloudflare (1.1.1.1), Quad9, OpenDNS | DNS lookup failures cause cascading SaaS app downtime |
| CDN / Edge / WAF | Cloudflare, Akamai, Fastly | WAF or DDoS mitigation misconfigurations can lock out endpoints |
| Certificate Authorities | Let's Encrypt, DigiCert, GlobalSign, Sectigo | Certificate expiration or signing issues cause SSL failures |
| Internet Exchange Points / Backbone | Equinix, Cogent, Lumen (CenturyLink), NTT, Tata, Verizon | Major fiber or routing outages affect multiple cloud zones |
🔒 Security & Compliance Services
Dependence on third-party risk control services. Failure reduces security posture and detection capabilities.
| Type | Examples | Impact |
|---|---|---|
| Endpoint / Security Management | CrowdStrike, SentinelOne, Microsoft Defender, Sophos Central | Endpoint agents rely on cloud telemetry |
| Certificate Transparency / Policy | Mozilla, Chrome Root Program, Trust Stores | Root revocation or errors impact encrypted communications |
| Vulnerability / Threat Feeds | VirusTotal, Recorded Future, Qualys Cloud, Rapid7, Tenable.io | Loss can reduce detection capability |
🔧 Supporting Infrastructure
Auxiliary services that support core operations. While not always critical, failure can degrade functionality or security.
| Function | Providers | Impact |
|---|---|---|
| Time Sync (NTP) | Google Public NTP, Microsoft NTP, pool.ntp.org | Incorrect time can invalidate TLS or authentication |
| SMS / Voice APIs | Twilio, Nexmo (Vonage), Plivo, MessageBird | Affects two-factor and alerting systems |
| GeoIP / Location Services | MaxMind GeoLite, IPinfo, Google Maps APIs | Affects login risk checks, geolocation features |
Risk Assessment Framework
Dependencies are categorized by risk level based on their potential impact on core business operations.
Critical
Complete service outage. Authentication, payments, core backend services. Immediate business impact.
High
Major feature degradation. JavaScript frameworks, real-time features, error monitoring. Significant UX impact.
Medium
Partial feature loss. CSS frameworks, utilities, analytics, customer engagement. Degraded but functional.
Low
Cosmetic impact only. Fonts, icons. Core functionality remains intact with graceful degradation.
🛡️
Defensive IT Mitigation Strategy
This comprehensive catalogue illustrates the extensive third-party dependency ecosystem inherent in modern web applications. Each dependency represents a potential single point of failure.
Survivable hybrid cloud architectures minimize exposure by self-hosting critical dependencies, implementing graceful degradation, maintaining offline capability, and designing for zero external dependencies in core operational paths. Use the Dependency Scanner Tool to assess your own application's third-party risk exposure.