Non-Vulnerable Dependency Resolution
summary
Proposal: merge dependency constraints with vulnerability version ranges so resolvers avoid selecting vulnerable versions. Uses a normalized identifier (Package URL), a new normalized version-range syntax, and an aggregated vulnerability database (NVD + OSV + GitLab + vendor advisories). A proof-of-concept in python-inspector runs the resolver against both constraint ranges and vulnerable ranges to produce a nonvulnerable dependency resolution; it works but often returns no feasible tree because many packages (roughly 30–40 open-source vulns/day) lack nonvulnerable combinations.
AI-written summary · about
chapters (14)
- 0:00Non-vulnerable dependency resolution
- 2:41What dependency resolution means
- 5:53Vulnerabilities and CVEs
- 7:45Package URL and version standards
- 12:00Python Inspector tool
- 13:26Vulnerability databases challenges
- 19:24NDR and non-vulnerable resolution
- 24:07Use cases for non-vulnerable resolution
- 31:14Beyond Python to other ecosystems
- 33:25Open data for package metadata
- 45:13Federated code and open infrastructure
- 51:52Why repos host vulnerable packages
- 52:13Handling downstream repackaged software
- 59:12Q&A
related talks
15mA vulnerability database should not be about vulnerabilities!
32mA Vulnerability Database Should Not Be About Vulnerabilities!
24mPurl and Vers: The Mostly Universal Package URL & Version Ranges Identifiers for Dependencies &...
39mTrials and Tribulations of Updating Dependencies for Vulnerability...
39mUsing GraphDB Technology to Resolve Transitive Vulnerabilities at Scale
11mVulnerability Supply Chains
58mWhy Can't We All Just Get Along? Bridging the Gap in Vulnerability Prioritization Standards
40mDependency Management: The Cause of—and Solution to—All Supply...