How do you compile and maintain a list of 3rd party software services being integrated in your code base by devs?

I would also add to this the increasing number of Javascript libraries.   As we're not using CDNJS or anything similar but rather deploy the libraries in our own environment, maintaining and keeping track of them is complex.

This is specially true when it comes to security issues requiring to update the librairies.

Who owns the process for formal ticketing? is it Product management, security, GRC and How is the hammer brought down? essentially in too many places I have seen the process exist but to actually see it work given differing levels of commitment via PMs is a major issue from an implementation perspective.

What custom tools have you built?especially given that 3rd party APIs are rarely ever in openapi2/swagger compliant spec.