All About Dependencies
summary
Dependencies speed delivery but also cause real failures: five notable incidents are named — left-pad unpublished 2016, npm chown bug 2018, event-stream malicious package 2018, is-promise outage 2020, colors infinite loop 2022 — showing supply-chain risk. The claim is that a mature artifact manager plus security scanning reduces those risks; concrete tooling is JFrog Artifactory with automated deep scans via Xray and the OSS scorecard heuristics. The built outcome is repository separation, automated advisories and binary-level analysis that actually detect and block malicious or broken packages.
AI-written summary · about
related talks
55mCI Pulled It, Prod Ran It: The Real Risk in Dependency, by GraphsIlkka Turunen
26mKnow Your Dependencies: A Guide to Automating Dependency Assurance
05mDependency Demons
32mAdapting DevOps in a World of Growing Software Supply Chain Attacks
32mFrom Code to Trusted Release
37mKeep Your Dependencies in Check
29mDependency Management: Where the Fork are We?
36mBuilding a Trusted and Resilient Software Supply Chain