Quantifying your reliance on Open Source software
summary
Built an open source command‑line pipeline that ingests Renovate, GitHub Dependabot/Dependable APIs and other package data, stores it in a sqlite database and serves a small web UI and reusable SQL reports. Uses endoflife.date and advisory feeds to flag EOL and vulnerable packages, surfaces who owns outdated stacks, and traced a Datadog SDK mandatory update to all affected teams. Real deployments found surprising scale like 551 major Node updates pending and numerous long‑stale forks.
AI-written summary · about
related talks
37mKeep Your Dependencies in Check
17mBuilding Secure Open Source Communities From the Ground Up
29mA journey of the thousand binaries
47mUnder the Radar: How we found 0-days in the Build Pipeline of OSS Packages
20mJuggling the dual life of an enterprise open source project
31mAssessing Open Source Software Projects in the Software Supply Chain
30mBringing Continuous Delivery to Open Source
40mDependency Management: The Cause of—and Solution to—All Supply...