Know thy neighbours: dependency management done right.
summary
A 222‑line demo app with five direct dependencies pulls in 54 total artifacts and ends up shipping roughly ~450,000 lines of third‑party code, so responsibility for those transitive libraries matters. Demonstrates a live arbitrary code execution via an outdated spring‑data‑rest and shows concrete commands and tools: mvn versions:display-dependency-updates and mvn dependency:analyze, npm depth‑check, Gradle Nebula plugins and SNEAK for continuous scanning. Advice: pick only needed libs, update frequently, and remove unused ones.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 1:10Trust in software
- 6:05Who is Brian
- 6:48Dependencies in Java apps
- 10:46Step 1: Picking dependencies
- 14:46Step 2: Maintaining dependencies
- 19:00Security vulnerabilities
- 21:07Live demo of exploit
- 26:11Step 3: Removing dependencies
- 31:29Summary and best practices
- 37:28Q&A
related talks
37mKeep Your Dependencies in Check
55mCI Pulled It, Prod Ran It: The Real Risk in Dependency, by GraphsIlkka Turunen
26mKnow Your Dependencies: A Guide to Automating Dependency Assurance
05mDependency Demons
42mDependency Updates: Before and After
29mDependency Management: Where the Fork are We?
31mKeep your dependencies in check
33mTaming Java Dependencies in 70+ GCP Client Libraries