Going Beyond Metadata: Why We Need to Think of Adopting Static Analysis in Dependency Tools
summary
Argues that metadata-only dependency tools produce many false positives for transitive libraries and that lightweight static analysis — especially call graphs — gives far better actionability: direct dependency counts often match between metadata and code, but 60% of transitive dependencies are never called, so alerts can be cut dramatically. Shows feasibility by building call graphs for 23,767 packages and 140k releases in 10 days. Notes trade-offs: compiled languages are easier, dynamic codegen and reflection cause false negatives, and heavy precision hurts scalability.
AI-written summary · about
chapters (5)
- 0:00Start
- 4:59Package Manifest
- 15:51Transitive Dependencies
- 19:31Test Dependencies
- 40:03The Source of False Negatives
related talks
30mWhy We Need to Adopt Static Analysis in Dependency Tools
23mPrioritisation of SCA Findings in Software Dependencies Using Static Reachability Analysis
10mLightning Talk: Scoring Dependencies to Detect “Weak Links” in your Open-source So...
30mDependency management: the cause of—and solution to—all supply chain problems
27mDependency hell - Or, Developers' perception of software dependencies
51mThe great SAST dissonance: how to please every... (Claudio Merloni, Romain Gaucher)
01h 01mMake Friends with the Clang Static Analysis Tools
05mDependency Demons