Dependency Demons
summary
Explains how modern projects tracked in package.json/package-lock.json balloon into deep transitive trees that cause duplicated libraries, version conflicts (the diamond dependency problem), and bloated runtimes; shows concrete risks: lingering CVEs, discovered components using ELV2 licenses, and attack vectors like typo-squatting and account takeover that publish malicious releases; notes org-level dependency chains that make upgrades take weeks-to-months and argues these hidden links cause systemic decay and supply-chain compromise.
AI-written summary · about
related talks
27mDependency hell - Or, Developers' perception of software dependencies
40mDependency Management: The Cause of—and Solution to—All Supply...
46mNavigating the Dependency Management Maze
30mDependency management: the cause of—and solution to—all supply chain problems
38mKnow thy neighbours: dependency management done right.
08mAll About Dependencies
46mDependency Confusion: What It Is and How to Defend Against It
38mDependency Management: The Cause of—and Solution to—All Supply Chain Problems