BoF: Community Health and Vulnerability Mitigation
summary
Discussion of tracking transitive and circular dependencies with concrete metrics: CHAOSS’s upstream dependencies count, a libyar age metric (days since latest library release), and GitHub dependabot responsiveness as a proxy for maintenance. Demonstrations include weekly libyar trend runs, using OSF scorecards and SBOM-style inventories to map exposure to CVEs, and student community-architecture exercises that combine project health signals with dependency aging to prioritize fixes and assess risk.
AI-written summary · about
chapters (4)
related talks
54mSupply Chain Sec /w Dependency Track
22mOn the Shoulders of Giants: Security in FOSS
40mUnderstanding OSS Risk Beyond Code Vulnerabilities
43mThe Burden of Knowledge: Dealing With Open Source Risks
24mDependency Track Fortifying The Supply Chain
27mHealth Check-ups on OSS Software Projects: Managing Risks While Promoting (Re)use
36mBoF
40mDependency Management: The Cause of—and Solution to—All Supply...