Navigating the Dependency Management Maze
summary
Compares dependency-management practices across ecosystems: Maven’s dependencyManagement and BOM imports, Gradle’s dependency locking and conflict-of-implementation check, and npm’s package-lock plus tools like npm dedupe and updaters (Dependabot, Renovate). Presents a real malicious npm package incident that injected backdoor code during builds, notes repository scale differences (Maven Central ~50 TB vs npm hundreds of GB), and argues for using SBOMs such as CycloneDX and tools like dependencyInsight to produce accurate inventories and enable remediation.
AI-written summary · about
chapters (5)
- 0:00Introduction
- 10:12Dependency fundamentals
- 23:53Conflict resolution tools
- 36:00SBOM and inventories
- 45:57Q&A
related talks
30mDependency management: the cause of—and solution to—all supply chain problems
42mSponsored Session: Dependencies: Do's and Don'ts
38mDependency Management: The Cause of—and Solution to—All Supply Chain Problems
40mDependency Management: The Cause of—and Solution to—All Supply...
05mDependency Demons- 38mDependency Management: The Cause of—and Solution to—All Supply...
30mSnow Nor Rain Nor Dependency Confusion: How to...
54mSupply Chain Sec /w Dependency Track