Dependency management: the cause of—and solution to—all supply chain problems
0 likes31 views
The document discusses dependency management in software development, highlighting how it influences vulnerability remediation as supply chain attacks increase. It outlines the complexity of dependency resolution, the evolution of dependency graphs over time, and the need for effective strategies to manage these dependencies. Key statistics include the gradual remediation timeline for vulnerabilities like Log4shell, illustrating the challenges faced in timely fixes for affected packages.
![deps.dev
Open vs pinned requirements
● Open
○ NPM: ^1.0.0
○ Maven: [1.0,)
○ NuGet: [1.0.0,]
○ Cargo: >= 1.0.0
○ PyPI: >=1.0.0
● Pinned
○ NPM: =1.0.0
○ Maven: 1.0.0
○ NuGet: [1.0.0]
○ Cargo: =1.0.0
○ PyPI: ==1.0.0](https://image.slidesharecdn.com/dependencymanagementthecauseof-andsolutionto-allsupplychainproblems-241113164544-98493919/85/Dependency-management-the-cause-of-and-solution-to-all-supply-chain-problems-64-320.jpg)
![deps.dev
Open vs pinned requirements
● Open
○ NPM: ^1.0.0
○ Maven: [1.0,)
○ NuGet: [1.0.0,]
○ Cargo: >= 1.0.0
○ PyPI: >=1.0.0
● Pinned
○ NPM: =1.0.0
○ Maven: 1.0.0
○ NuGet: [1.0.0]
○ Cargo: =1.0.0
○ PyPI: ==1.0.0](https://image.slidesharecdn.com/dependencymanagementthecauseof-andsolutionto-allsupplychainproblems-241113164544-98493919/85/Dependency-management-the-cause-of-and-solution-to-all-supply-chain-problems-65-320.jpg)
![deps.dev
Open vs pinned requirements
● Open
○ NPM: ^1.0.0
○ Maven: [1.0,)
○ NuGet: [1.0.0,]
○ Cargo: >= 1.0.0
○ PyPI: >=1.0.0
● Pinned
○ NPM: =1.0.0
○ Maven: 1.0.0
○ NuGet: [1.0.0]
○ Cargo: =1.0.0
○ PyPI: ==1.0.0](https://image.slidesharecdn.com/dependencymanagementthecauseof-andsolutionto-allsupplychainproblems-241113164544-98493919/85/Dependency-management-the-cause-of-and-solution-to-all-supply-chain-problems-66-320.jpg)
![deps.dev
Open vs pinned requirements
● Open
○ NPM: ^1.0.0 >=1,<2
○ Maven: [1.0,)
○ NuGet: [1.0.0,]
○ Cargo: >= 1.0.0
○ PyPI: >=1.0.0
● Pinned
○ NPM: =1.0.0
○ Maven: 1.0.0
○ NuGet: [1.0.0]
○ Cargo: =1.0.0
○ PyPI: ==1.0.0](https://image.slidesharecdn.com/dependencymanagementthecauseof-andsolutionto-allsupplychainproblems-241113164544-98493919/85/Dependency-management-the-cause-of-and-solution-to-all-supply-chain-problems-67-320.jpg)
![deps.dev
Dependency requirements in Maven are often pinned
1. A version number: 1.0
“1.0 or a later version, if 1.0 is not available.”
2. Ends in a closed range, [1.0.0,2.0.3] or [1.0.0,2.0.3)
1.0.0 <= x <= 2.0.3 or 1.0.0 <= x < 2.0.3
3. Ends in an open range, [1.0,)
1.0 <= x
99%
<1%
<1%
Computed by deps.dev.](https://image.slidesharecdn.com/dependencymanagementthecauseof-andsolutionto-allsupplychainproblems-241113164544-98493919/85/Dependency-management-the-cause-of-and-solution-to-all-supply-chain-problems-79-320.jpg)
Dependency management: the cause of—and solution to—all supply chain problems
- 1. Learn more at deps.dev Eve Martin-Jones, Josie Anugerah Software Engineers, Google Dependency management: the cause of - and solution to - all supply chain problems
- 2. deps.dev Google Open Source Security Team securityscorecards.dev slsa.dev osv.dev …and more { deps.dev GOSST
- 4. deps.dev Open source software continues to grow Source: Sonatype. 4
- 5. deps.dev Supply chain attacks are increasing Source: Sonatype. 5
- 6. deps.dev Our remediation strategies aren’t keeping up Source: Sonatype. 6
- 7. deps.dev
- 8. deps.dev log4shell discovered Remediation timeline: log4shell APR 22 MAY 22 JUN 22 JUL 22 AUG 22 SEP 22 OCT 22 NOV 22 DEC 22 FEB 22 NOV 21 DEC 21 MAR 22 JAN 22
- 9. deps.dev Remediation timeline: log4shell 13% of packages affected by log4shell fixed after 1 week APR 22 MAY 22 JUN 22 JUL 22 AUG 22 SEP 22 OCT 22 NOV 22 DEC 22 FEB 22 NOV 21 DEC 21 MAR 22 JAN 22 log4shell discovered
- 10. deps.dev Remediation timeline: log4shell 13% of packages affected by log4shell fixed after 1 week APR 22 MAY 22 JUN 22 JUL 22 AUG 22 SEP 22 OCT 22 NOV 22 DEC 22 25% of packages affected by log4shell fixed after 10 days FEB 22 NOV 21 DEC 21 MAR 22 JAN 22 log4shell discovered
- 11. deps.dev Remediation timeline: log4shell ~40% of packages affected by log4shell fixed after a few months 13% of packages affected by log4shell fixed after 1 week APR 22 MAY 22 JUN 22 JUL 22 AUG 22 SEP 22 OCT 22 NOV 22 DEC 22 25% of packages affected by log4shell fixed after 10 days FEB 22 NOV 21 DEC 21 MAR 22 JAN 22 log4shell discovered
- 12. deps.dev ~40% of packages affected by log4shell fixed after a few months ~70% of packages affected by log4shell fixed by end of year 13% of packages affected by log4shell fixed after 1 week APR 22 MAY 22 JUN 22 JUL 22 AUG 22 SEP 22 OCT 22 NOV 22 DEC 22 25% of packages affected by log4shell fixed after 10 days FEB 22 NOV 21 DEC 21 MAR 22 JAN 22 Remediation timeline: log4shell log4shell discovered
- 13. deps.dev
- 14. deps.dev Remediation timeline: colors APR 22 MAY 22 JUN 22 JUL 22 AUG 22 SEP 22 OCT 22 NOV 22 DEC 22 FEB 22 Malicious colors versions published NOV 21 DEC 21 MAR 22 JAN 22 ~40% of packages affected by log4shell fixed after a few months ~70% of packages affected by log4shell fixed by end of year log4shell discovered APR 22 MAY 22 JUN 22 JUL 22 AUG 22 SEP 22 OCT 22 NOV 22 DEC 22 25% of packages affected by log4shell fixed after 10 days FEB 22 NOV 21 DEC 21 MAR 22 JAN 22 13% of packages affected by log4shell fixed after 1 week
- 15. deps.dev APR 22 MAY 22 JUN 22 JUL 22 AUG 22 SEP 22 OCT 22 NOV 22 DEC 22 FEB 22 Malicious colors versions published NOV 21 DEC 21 MAR 22 JAN 22 100% of packages affected by colors fixed after 3 days Remediation timeline: colors ~40% of packages affected by log4shell fixed after a few months ~70% of packages affected by log4shell fixed by end of year log4shell discovered APR 22 MAY 22 JUN 22 JUL 22 AUG 22 SEP 22 OCT 22 NOV 22 DEC 22 25% of packages affected by log4shell fixed after 10 days FEB 22 NOV 21 DEC 21 MAR 22 JAN 22 13% of packages affected by log4shell fixed after 1 week
- 17. deps.dev 1. What is dependency resolution? 2. What does a typical dependency graph look like? 3. Dependency graphs change over time 4. How dependency management affects vulnerability remediation 5. Solutions for managing your dependencies at scale Agenda
- 18. 1. What is dependency resolution?
- 19. deps.dev Each dependency is actually a set of constraints/requirements A B >= 1.5
- 20. deps.dev The dependency resolution algorithm decides which versions are included B 1.0.0 B 1.5.1 A ? B >= 1.5
- 21. deps.dev Each ecosystem has its own dependency resolution tools ● go mod ● cargo install ● nuget add ● pip install ● ....
- 22. deps.dev The dependency resolution algorithm decides which versions are included B 1.0.0 B 1.5.1 A B >=1.5
- 23. deps.dev Dependencies have dependencies (which have dependencies....) C 2.0.0 B 1.5.1 A B >=1.5 C >= 2
- 24. deps.dev Dependency resolution is constraint satisfaction B 1.5.1 A B >=1.5 C >= 2 X ? X >= 1
- 25. deps.dev Dependency resolution is constraint satisfaction B 1.5.1 A B >=1.5 C >= 2 X 1.0.0 X >= 1 X 1.1.0 X 1.0.2 C >= 2 C >= 2.1 C =1.0.1 ?
- 26. deps.dev Dependency resolution is constraint satisfaction B 1.5.1 A B >=1.5 C >= 2 X 1.0.0 C >= 2 ? X >= 1
- 27. deps.dev Dependency resolution is constraint satisfaction B 1.5.1 A B >=1.5 C >= 2 X 1.0.0 C >= 2 C 2.0.0 X >= 1
- 28. deps.dev Dependency resolution is constraint satisfaction B 1.5.1 A B >=1.5 C >= 2 X 1.1.0 X >= 1 C >= 2.1 ?
- 29. deps.dev Dependency resolution is constraint satisfaction B 1.5.1 A B >=1.5 C >= 2 X 1.1.0 C >= 2.1 C 2.1.0 X >= 1
- 30. deps.dev The diamond dependency problem B 1.5.1 A B >=1.5 C >= 2 X 1.2.0 C =1.0.1 X >= 1 ☹
- 31. deps.dev The diamond dependency problem B 1.5.1 A B >=1.5 C >= 2 X 1.0.0 X >= 1 X 1.1.0 X 1.2.0 C >= 2 C >= 2.1 C =1.0.1 ?
- 32. deps.dev The diamond dependency problem B A B >=1.5 X ? X >= 1 ?
- 33. deps.dev Dependency resolution is NP-complete
- 34. deps.dev Sudoku solver 6 4 2 9 3 9 4 5 8 2 1 9 7 5 6 8 2 7 5 1 8 4 6
- 39. deps.dev Sudoku solver 6 4 2 9 3 9 4 5 8 2 1 9 7 5 6 8 2 7 5 1 8 4 6
- 40. deps.dev Sudoku solver 1 6 4 5 3 7 8 2 9 2 8 5 1 6 9 7 4 3 3 9 7 2 4 8 6 1 5 4 5 1 8 9 3 2 6 7 8 7 6 4 5 2 9 3 1 9 2 3 7 1 6 4 5 8 6 3 8 9 2 5 1 7 4 5 4 9 6 7 1 3 8 2 7 1 2 3 8 4 5 6 6
- 41. deps.dev 2x2 sudoku solver 0 A B D C
- 42. deps.dev 2x2 sudoku solver 0 1 1 A B D C
- 43. deps.dev 2x2 sudoku solver 0 1 1 0 A B D C
- 45. deps.dev 2x2 sudoku solver 0 A B D C B 0.0.0 C 0.0.0 B ! = 0 C ! = 0 B 1.0.0 ? C 1.0.0 ? A 0.0.0 A=0 Project
- 46. deps.dev 2x2 sudoku solver 0 1 1 A B D C B 1.0.0 C 1.0.0 B ! = 0 C ! = 0 A 0.0.0 A=0 Project
- 47. deps.dev 2x2 sudoku solver 0 1 1 A B D C B 1.0.0 C 1.0.0 D 0.0.0 B ! = 0 D ! = 1 C ! = 0 D ! = 1 D 1.0.0 ? A 0.0.0 A=0 Project
- 48. deps.dev 2x2 sudoku solver 0 1 1 0 A B D C B 1.0.0 C 1.0.0 D 0.0.0 B ! = 0 D ! = 1 C ! = 0 D ! = 1 A 0.0.0 A=0 Project
- 49. deps.dev Sudoku solver AA Package AA Version 1 A B C D E F G H I A B C D E F G H I
- 50. deps.dev Sudoku solver AA AB AC AD AE AF AG AH AI Package AA Version 1 Constraints: BA!=1 CA!=1 DA!=1 EA!=1 FA!=1 GA!=1 HA!=1 IA!=1 (row) A B C D E F G H I A B C D E F G H I
- 51. deps.dev Sudoku solver AA AB AC AD AE AF AG AH AI BA CA DA EA FA GA HA IA Package AA Version 1 Constraints: BA!=1 CA!=1 DA!=1 EA!=1 FA!=1 GA!=1 HA!=1 IA!=1 (row) AB!=1 AC!=1 AD!=1 AE!=1 AF!=1 AG!=1 AH!=1 AI!=1 (column) A B C D E F G H I A B C D E F G H I
- 52. deps.dev Sudoku solver AA AB AC AD AE AF AG AH AI BA BB BC CA CB CC DA EA FA GA HA IA Package AA Version 1 Constraints: BA!=1 CA!=1 DA!=1 EA!=1 FA!=1 GA!=1 HA!=1 IA!=1 (row) AB!=1 AC!=1 AD!=1 AE!=1 AF!=1 AG!=1 AH!=1 AI!=1 (column) AB!=1 AC!=1 BA!=1 BB!=1 BC!=1 CA!=1 CB!=1 CC!=1 (square) A B C D E F G H I A B C D E F G H I
- 53. deps.dev Sudoku solver AA AB AC AD AE AF AG AH AI BA BB BC CA CB CC DA EA FA GA HA IA Package AA Version 1 Constraints: BA!=1 CA!=1 DA!=1 EA!=1 FA!=1 GA!=1 HA!=1 IA!=1 (row) AB!=1 AC!=1 AD!=1 AE!=1 AF!=1 AG!=1 AH!=1 AI!=1 (column) AB!=1 AC!=1 BA!=1 BB!=1 BC!=1 CA!=1 CB!=1 CC!=1 (square) And likewise for package AA version 2, 3, etc. And likewise for package AB, AC…!! A B C D E F G H I A B C D E F G H I
- 54. deps.dev Sudoku solver 0 1 1 0 �� �� ��
- 55. deps.dev Vulnerability remediation requires you to reverse engineer your resolution graph
- 56. 2. What is a "typical" dependency graph?
- 57. deps.dev A simple dependency graph B A X C
- 58. deps.dev average number of direct dependencies for an npm package 6 average number of indirect dependencies for an npm package 110 Computed by deps.dev.
- 59. deps.dev Average number of dependencies Computed by deps.dev.
- 60. deps.dev A not-so-simple dependency graph A dependency graph for the npm package express @4.18.2
- 61. deps.dev :O A dependency graph for the Go module k8s.io/kubernetes@1.29.3
- 62. deps.dev Large dependency graphs can make it hard to identify and remediate vulnerabilities
- 63. 3. Dependency graphs change over time
- 64. deps.dev Open vs pinned requirements ● Open ○ NPM: ^1.0.0 ○ Maven: [1.0,) ○ NuGet: [1.0.0,] ○ Cargo: >= 1.0.0 ○ PyPI: >=1.0.0 ● Pinned ○ NPM: =1.0.0 ○ Maven: 1.0.0 ○ NuGet: [1.0.0] ○ Cargo: =1.0.0 ○ PyPI: ==1.0.0
- 65. deps.dev Open vs pinned requirements ● Open ○ NPM: ^1.0.0 ○ Maven: [1.0,) ○ NuGet: [1.0.0,] ○ Cargo: >= 1.0.0 ○ PyPI: >=1.0.0 ● Pinned ○ NPM: =1.0.0 ○ Maven: 1.0.0 ○ NuGet: [1.0.0] ○ Cargo: =1.0.0 ○ PyPI: ==1.0.0
- 66. deps.dev Open vs pinned requirements ● Open ○ NPM: ^1.0.0 ○ Maven: [1.0,) ○ NuGet: [1.0.0,] ○ Cargo: >= 1.0.0 ○ PyPI: >=1.0.0 ● Pinned ○ NPM: =1.0.0 ○ Maven: 1.0.0 ○ NuGet: [1.0.0] ○ Cargo: =1.0.0 ○ PyPI: ==1.0.0
- 67. deps.dev Open vs pinned requirements ● Open ○ NPM: ^1.0.0 >=1,<2 ○ Maven: [1.0,) ○ NuGet: [1.0.0,] ○ Cargo: >= 1.0.0 ○ PyPI: >=1.0.0 ● Pinned ○ NPM: =1.0.0 ○ Maven: 1.0.0 ○ NuGet: [1.0.0] ○ Cargo: =1.0.0 ○ PyPI: ==1.0.0
- 68. deps.dev Oldest or newest? B 1.0.0 B 1.5.0 B 1.6.0 A ? B >= 1.5.0 oldest? Only get new features, fixes, bugs when you choose to update requirement Go/NuGet newest? freshest features/bug fixes! :) freshest new bugs? :( npm, Cargo, pip doesn't match constraint
- 69. deps.dev Dependency graphs change as new versions are published B 1.0.0 A B 1.0.1 B ^1.0.0 ? Time = 0 npm
- 70. deps.dev Dependency graphs change as new versions are published B 1.0.0 A B 1.0.1 npm B ^1.0.0 Time = 0
- 71. deps.dev Dependency graphs change as new versions are published B 1.0.0 A B 1.0.1 ? B 1.0.2 npm B ^1.0.0 Time = 1
- 72. deps.dev Dependency graphs change as new versions are published B 1.0.0 A B 1.0.1 B 1.0.2 npm B ^1.0.0 Time = 1
- 73. deps.dev Dependency graphs change as new versions are published B 1.0.0 A B 1.0.1 B 1.0.2 C npm B ^1.0.0 Time = 1
- 74. deps.dev Computed by deps.dev. PYPI npm Daily proportion of versions with graph changes (Oct 2024)
- 75. deps.dev Of the ~22 million npm package versions see a change in their licence set or vulnerability set every day 40,000 Computed by deps.dev.
- 76. deps.dev The dependency graph you’re managing constantly changes.
- 77. 4. What does this mean for vulnerability remediation?
- 78. Proprietary + Confidential Of the time a package is affected by a vulnerability, it’s affected indirectly. 98% Computed by deps.dev: From all published libraries across npm, Go, Maven, PyPI, and Cargo
- 79. deps.dev Dependency requirements in Maven are often pinned 1. A version number: 1.0 “1.0 or a later version, if 1.0 is not available.” 2. Ends in a closed range, [1.0.0,2.0.3] or [1.0.0,2.0.3) 1.0.0 <= x <= 2.0.3 or 1.0.0 <= x < 2.0.3 3. Ends in an open range, [1.0,) 1.0 <= x 99% <1% <1% Computed by deps.dev.
- 80. deps.dev Remediating vulnerabilities in a dependency graph A 1.0.0 Project ! A=1.0.0
- 81. deps.dev Remediating vulnerabilities in a dependency graph A 1.0.0 Project ! A 1.0.1 A=1.0.1
- 82. deps.dev B 1.0.0 Project A 1.0.0 ! A =1.0.0 B=1.0.0 Remediating vulnerabilities in a dependency graph
- 83. deps.dev B 1.0.0 Project A 1.0.0 ! B 1.0.1 A =1.0.0 B=1.0.0 Remediating vulnerabilities in a dependency graph
- 84. deps.dev B 1.0.0 Project A 1.0.0 ! B 1.0.1 A 1.0.1 B=1.0.1 A =1.0.0 B=1.0.0 Remediating vulnerabilities in a dependency graph
- 85. deps.dev B 1.0.0 Project A 1.0.0 ! B 1.0.1 A 1.0.1 A=1.0.1 B=1.0.1 B=1.0.0 Remediating vulnerabilities in a dependency graph
- 86. deps.dev D 1.0.0 Project C 1.0.0 ! B 1.0.0 A 1.0.0 A=1.0.0 B=1.0.0 C=1.0.0 D=1.0.0 Remediating vulnerabilities in a dependency graph
- 87. deps.dev ! A=1.0.1 D 1.0.0 Project C 1.0.0 ! B 1.0.0 A 1.0.0 B=1.0.1 C=1.0.1 D=1.0.1 Remediating vulnerabilities in a dependency graph D 1.0.1 C 1.0.1 B 1.0.1 A 1.0.1
- 89. deps.dev How was log4j introduced? log4j? Maven package Depth 1 ! 20% Computed by deps.dev.
- 90. deps.dev How was log4j introduced? log4j? Maven package log4j? log4j? log4j? log4j? Depth 1 Depth 2 Depth 3 Depth 4 Depth 5 20% ! ! 80% ! ! ! Computed by deps.dev.
- 91. deps.dev ~40% of packages affected by log4shell fixed after a few months ~70% of packages affected by log4shell fixed by end of year 13% of packages affected by log4shell fixed after 1 week APR 22 MAY 22 JUN 22 JUL 22 AUG 22 SEP 22 OCT 22 NOV 22 DEC 22 25% of packages affected by log4shell fixed after 10 days FEB 22 NOV 21 DEC 21 MAR 22 JAN 22 Remediation timeline: log4shell log4shell discovered
- 92. deps.dev Issues in your dependency graph can be hard to fix.
- 93. deps.dev ! A=1.0.1 D 1.0.0 Project C 1.0.0 ! B 1.0.0 A 1.0.0 B=1.0.1 C=1.0.1 D=1.0.1 D 1.0.1 C 1.0.1 B 1.0.1 A 1.0.1 Remediating vulnerabilities in a dependency graph
- 94. deps.dev Go: Specifying from the root Project D 1.0.1 D = 1.0.1 Go D 1.0.0 C 1.0.0 B 1.0.0 A 1.0.0 !
- 95. deps.dev Dependency requirements in npm are often open 1. Allow new patches (~) 2. Allow compatible versions (patch or minor, ^) 3. Use neither 71% 3% 26%
- 96. deps.dev D 1.0.0 Open requirements in indirect vulnerability remediation ! D 1.0.1 D ^1.0.0 npm Project C 1.0.0 B 1.0.0 A 1.0.0
- 97. deps.dev Version selection in log4npm? npm
- 98. deps.dev Case study: colors Unaffected earlier releases 1.4.x (unaffected) 1.4.1 (affected) 1.4.2 (affected) ! ! Resolution Time Dependent packages
- 99. deps.dev Case study: colors Unaffected earlier releases 1.4.x (unaffected) 1.4.1 (affected) 1.4.2 (affected) ! ! Resolution Time Dependent packages
- 100. deps.dev Case study: colors Unaffected earlier releases 1.4.x (unaffected) 1.4.1 (affected) 1.4.2 (affected) ! ! Resolution Time Dependent packages
- 101. deps.dev Case study: colors Unaffected earlier releases 1.4.x (unaffected) 1.4.1 (affected) 1.4.2 (affected) ! ! Resolution Time Dependent packages
- 102. deps.dev Case study: colors Unaffected earlier releases 1.4.x (unaffected) 1.4.1 (affected) 1.4.2 (affected) ! ! Resolution Time Dependent packages
- 103. deps.dev Case study: colors Unaffected earlier releases 1.4.x (unaffected) 1.4.1 (affected) 1.4.2 (affected) ! ! Resolution Time Dependent packages
- 104. deps.dev Case study: colors Unaffected earlier releases 1.4.x (unaffected) 1.4.1 (affected) 1.4.2 (affected) ! ! Resolution Time Dependent packages
- 105. deps.dev APR 22 MAY 22 JUN 22 JUL 22 AUG 22 SEP 22 OCT 22 NOV 22 DEC 22 FEB 22 Malicious colors versions published NOV 21 DEC 21 MAR 22 JAN 22 100% of packages affected by colors fixed after 3 days Remediation timeline: colors ~40% of packages affected by log4shell fixed after a few months ~70% of packages affected by log4shell fixed by end of year log4shell discovered APR 22 MAY 22 JUN 22 JUL 22 AUG 22 SEP 22 OCT 22 NOV 22 DEC 22 25% of packages affected by log4shell fixed after 10 days FEB 22 NOV 21 DEC 21 MAR 22 JAN 22 13% of packages affected by log4shell fixed after 1 week
- 106. deps.dev Should all projects use open requirements and all resolvers choose latest versions?
- 107. deps.dev Case study: event-stream Source: blog.npmjs.org.
- 109. deps.dev Case study: event-stream Source: blog.npmjs.org. hey mate I can maintain event-stream for you if u want???? o sweet! thx! Here u go �� �� ��
- 110. deps.dev Case study: event-stream Source: blog.npmjs.org. hey mate I can maintain event-stream for you if u want???? o sweet! thx! Here u go �� ��
- 111. deps.dev Case study: event-stream Source: blog.npmjs.org. !
- 112. deps.dev Case study: event-stream Source: blog.npmjs.org. event-stream 3.3.5 A event-stream 3.3.4 ... event-stream ^3.0.0
- 113. deps.dev Case study: event-stream Source: blog.npmjs.org. event-stream 3.3.5 A event-stream 3.3.4 ... event-stream 3.3.6 ! event-stream ^3.0.0
- 114. deps.dev Case study: event-stream Source: blog.npmjs.org. event-stream 3.3.5 A event-stream 3.3.4 ... event-stream 3.3.6 ! event-stream ^3.0.0
- 115. deps.dev Case study: event-stream Source: snyk.io.
- 116. deps.dev Pinned vs open requirements Pinned More control over your dependencies Open Automatic updates
- 117. deps.dev Effective dependency management requires tradeoffs.
- 118. 5. Effective dependency management requires scalable solutions
- 120. deps.dev docs.deps.dev/api Scan continuously: osv-scanner in action
- 121. deps.dev docs.deps.dev/api Scan continuously: osv-scanner in action
- 122. deps.dev Scan continuously: osv-scanner in action
- 123. deps.dev Guided remediation with osv-scanner Source: opensource.googleblog.com
- 124. deps.dev Package health: OpenSSF Scorecard
- 125. deps.dev Package health: deps.dev website
- 126. deps.dev Scan continuously: deps.dev API docs.deps.dev/api
- 128. deps.dev In conclusion... ● Dependency resolution is complicated ● Dependency graphs are big and change over time ● Dependency management affects vulnerability remediation ● Effective dependency management requires scalable solutions
- 129. deps.dev Links ● Deps.dev ○ docs.deps.dev/api ○ docs.deps.dev/bigquery ● osv.dev ● securityscorecards.dev ● slsa.dev ● github.com/google/oss-fuzz ● sigstore.dev ● Send us feedback: depsdev@google.com