We Need a Standard for Open Source Package Requirements
summary
Argument: current ecosystems lack a common requirement spec, so Deps.dev analyzes millions of packages across npm, Cargo, Maven, PyPI and RubyGems and translates their syntaxes into an interval model that uses range, union and exclusion operators. The model powers an implemented library and is already used by OSV scanner to compute intersections, exclude vulnerable ranges, and pick the largest safe version. Findings include npm packages having >100 indirect deps, Cargo >50, and many ecosystem-specific quirks that the model reconciles.
AI-written summary · about
chapters (21)
- 0:00Open source requirements intro
- 1:26Threats in dependencies
- 3:12Versioning standards
- 8:12Shared requirement model
- 10:22Version ordering quiz
- 12:28Version spaces formalized
- 16:21Interval notation simplification
- 19:34Dependency resolution challenges
- 22:03OSV scanner remediation
- 23:52Scaling dependency graphs
- 24:56Standards adoption tips
- 25:55Q&A architecture constraints
- 27:19Q&A standardization limits
- 28:44Q&A tooling libraries
- 30:10Q&A external factors
- 31:57Q&A infinity semantics
- 34:23Q&A notation details
- 35:07Q&A version prerequisites
- 36:52Q&A ecosystem flexibility
- 37:34Q&A package manager engagement
- 38:36Q&A dependency graphs
related talks
30mDependency management: the cause of—and solution to—all supply chain problems
36mBuilding the Digital Commons for Software Supply Chain
37mNode.js Package Maintenance...
45mNext Gen Package Management
01h 01mAutomating dependency selection with open-source tools at scale
43mThe Burden of Knowledge: Dealing With Open Source Risks
37mThe State of Open Source Security
44mThe Social Coding Contract