Dependency management: the cause of—and solution to—all supply chain problems
summary
deps.dev shares hard numbers and tools: analysis across npm PyPI Maven Go NuGet and Cargo, a public API and BigQuery dataset, and examples of how npm yarn and pnpm produce different graphs. startling findings include 20% of PyPI packages change their dependency graphs multiple times per week and roughly 10^81 valid graphs for D3. practical takeaways are concrete: scan what actually installs in production, publish metadata not SBOMs for libraries, and lock applications not libraries, because dependency resolution behavior differs by tool.
AI-written summary · about
chapters (17)
- 0:00Dependency management intro
- 1:30What is Dep.Dev
- 2:57Open source risks
- 4:00Why resolution is complex
- 6:08D3’s dependency graph
- 8:53Multiple dependency graphs
- 9:14How resolution works
- 12:46Resolution in ecosystems
- 14:10Resolution differences example
- 15:59Resolution changes over time
- 17:02Impact of multiple tools
- 19:10Architecture’s effect on graphs
- 21:58Why graphs are not singular
- 22:38SBOM limitations
- 26:27Dependency management best practices
- 28:56Library author recommendations
- 29:19Call to action
related talks
38mDependency Management: The Cause of—and Solution to—All Supply Chain Problems- 38mDependency Management: The Cause of—and Solution to—All Supply...
40mDependency Management: The Cause of—and Solution to—All Supply...
46mNavigating the Dependency Management Maze
42mSecuring Your Software Supply Chain
05mDependency Demons
42mSponsored Session: Dependencies: Do's and Don'ts
27mDependency hell - Or, Developers' perception of software dependencies