Trials and Tribulations of Updating Dependencies for Vulnerability...
summary
OSV scanner implements guided remediation that resolves dependency graphs via deps.dev/open source insights, computes concrete patches, and writes fixes back to package manifests and lockfiles. On a Maven example it finds 39 of 46 fixed by updating 20 dependencies; on an npm dataset resolution alone drops 202 → 78 vulnerabilities and an in-place override relax strategies pipeline yields concrete upgrades (57 fixes from 36 packages for in‑place, override for POM overrides, relax for bumping direct deps). A noninteractive script runs tests and blocks unsafe upgrades.
AI-written summary · about
chapters (17)
- 0:00OSV and vulnerability remediation
- 1:05Dependency vulnerabilities example
- 3:32Fixing transitive dependencies
- 6:00Guided remediation in OSV Scanner
- 9:12Guided remediation benefits
- 13:24Maven dependency extraction
- 13:45npm dependencies considerations
- 15:52Querying with OSV API
- 16:36Counting in dependency graphs
- 18:43Remediation strategies
- 19:24Lock file remediation
- 21:28Maven manifest override
- 23:54npm manifest relax
- 27:03Prioritizing patches
- 29:34Automated remediation with tests
- 31:01OSV Scanner resources
- 31:22Q&A
related talks
40mDependency Management: The Cause of—and Solution to—All Supply...
13mManaging Vulnerabilities in Open-Source Dependencies
27mFind and Track the hidden vulnerabilities inside your dependencies
38mDependency Management: The Cause of—and Solution to—All Supply...
42mSponsored Session: Dependencies: Do's and Don'ts- 38mDependency Management: The Cause of—and Solution to—All Supply Chain Problems
31mKeep your dependencies in check
42mScan, Patch, VEX - Using Open Source Tools to Manage...