Why We Need to Adopt Static Analysis in Dependency Tools
summary
Claim: static analysis cuts irrelevant alerts by matching usage not metadata. Empirical result on the Rust ecosystem shows metadata reports a median of 17 transitive deps versus 6 actually used — roughly 60% of transitive deps unused. Manual checks of 34 cases find 3 declared but never imported and 16 non‑reachable transitive edges. Proof‑of‑concept effort built compilable packages in 10 days, arguing for lightweight, usage‑focused analysis for transitive deps while noting limits on dynamic features, scaling, and false negatives.
AI-written summary · about
chapters (13)
- 0:00Static analysis in dependency tools
- 2:00Software reuse drives adoption
- 4:11Package managers simplify management
- 6:44Risks in third-party dependencies
- 8:33Metadata analysis limitations
- 10:21Metadata vs actual code usage
- 12:52Static analysis scalability concerns
- 14:37Metadata vs static analysis in Rust
- 17:30Static analysis for unused dependencies
- 23:13Dependency analysis strategies
- 25:59Static analysis trade-offs
- 27:23False negatives in security analysis
- 29:53Conclusion
related talks
41mGoing Beyond Metadata: Why We Need to Think of Adopting Static Analysis in Dependency Tools
23mPrioritisation of SCA Findings in Software Dependencies Using Static Reachability Analysis
58mSecurity Static Analysis - Avoiding an Angry Mob of Engineers
29m“The Current State of (free) Static Analysis"
18mAuditing Rust Crates Effectively
18mJavaScript tooling has a blind spot: codebase-wide questions
39mPractical Static Analysis for Continuous Application Security
27mDependency hell - Or, Developers' perception of software dependencies