Keep your dependencies in check
summary
Many teams balance safety and speed by automating dependency updates with tools like Dependabot, Renovate, and Snyk while using build tools (Maven/Gradle) and IDE features to inspect dependency trees. An audited example shows 29% of Log4j downloads remain on vulnerable versions. Migration/refactoring tools such as OpenRewrite and Error Prone perform code transformations (JUnit4→5, Jakarta EE, Spring upgrades) and often produce PRs that build and test automatically, but failed builds still require manual fixes and review.
AI-written summary · about
chapters (8)
- 0:00Start
- 3:28Selecting dependencies
- 7:44Dependency information
- 12:43IntelliJ IDEA: Dependency Analyzer
- 13:45IntelliJ IDEA: Update dependencies
- 16:22Software Composition Analysis (SCA)
- 20:24Renovate configuration
- 27:28OpenRewrite
related talks
37mKeep Your Dependencies in Check
33mKeep your dependencies in check
29mDependency Management: Where the Fork are We?
26mKnow Your Dependencies: A Guide to Automating Dependency Assurance
42mDependency Updates: Before and After
39mTrials and Tribulations of Updating Dependencies for Vulnerability...
27mDependency hell - Or, Developers' perception of software dependencies
47mTales from the Dev Side: What Went Wrong, What We Fixe & What You Can Steal