Dependency Management: The Cause of—and Solution to—All Supply...
summary
Dependency graphs contain hundreds to thousands of transitive packages and change rapidly: depths.dev finds up to 25% daily graph churn in npm and PyPI, and about 40,000 of 22M npm versions change license or vuln sets each day. Vulnerabilities are usually indirect — 98% indirect vulnerabilities — so remediation often requires upstream maintainer action, which explains why Log4Shell left 30% of Maven packages unfixed a year later while the npm colors/Faker incident remediates in three days. Depths.dev offers a bigquery dataset and OSV Scanner guided remediation tools that automate minimal-resolution upgrades.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 1:24Why dependency management matters
- 4:56Dependency resolution basics
- 9:29Dependency resolution NP-complete
- 13:48Dependency graphs and vulnerabilities
- 16:17Pinned vs open requirements
- 20:48Real-world remediation impact
- 23:56Log4Shell remediation delay
- 26:47npm colors and Faker incident
- 29:34Event Stream attack risks
- 32:04Tradeoffs in dependency management
- 32:48Tools for dependency management
- 36:21Conclusion
- 36:45Q&A
related talks
38mDependency Management: The Cause of—and Solution to—All Supply...- 38mDependency Management: The Cause of—and Solution to—All Supply Chain Problems
30mDependency management: the cause of—and solution to—all supply chain problems
39mTrials and Tribulations of Updating Dependencies for Vulnerability...
42mSecuring Your Software Supply Chain
42mSponsored Session: Dependencies: Do's and Don'ts
46mNavigating the Dependency Management Maze
05mDependency Demons