Picking a Winner: How to Pick the Right Dependency (Resolution...
summary
Dependency resolution produces wildly different outcomes: D3 can yield about 10^81 possible graphs even though it lists only 30 direct deps and 2.3 million people download it weekly; ecosystems report 2.1 billion vulnerable Java component downloads monthly with ~96% avoidable fixes. Different resolvers behave differently—npm/cargo/pip prefer latest and can install multiple versions while pip enforces a single version; Maven/Go tend to pick the lowest—so library SBOMs aren’t reliable for consumers while SBOMs are meaningful for applications not libraries. Scan what you actually ship.
AI-written summary · about
chapters (9)
- 0:00Introduction to deps.dev
- 1:13Complexity of dependencies
- 7:11Understanding resolution
- 8:32Factors in graph variance
- 17:21Tooling and environmental impact
- 25:07SBOMs and security limitations
- 30:40Revisiting security standards
- 32:52Dependency best practices
- 37:20Q&A and closing
related talks
39mUsing GraphDB Technology to Resolve Transitive Vulnerabilities at Scale
47mDependency management? Model it!
12mPackage Management for Data Scientists
24mBuilding a Better Database: How GitHub Structures Their Advisory Database to Drive Developer ...
32mA Complex Web of Open Source Software Dependencies Risk
20mOSS Dependency Health: Towards Maturity and Sustainability Risk Assessment Model
58mHow Can Package Managers Handle ABI (In)compatibility in C++?
31mSix Degrees of Infiltration