Dependency hell - Or, Developers' perception of software dependencies
summary
Study of dependency practices across 25 companies in nine countries finds developers often ignore noisy alerts, postpone updates for fear of breaking changes, and rely on pre-approved library pools or social channels. Concrete tooling used includes GitHub Security Alerts, Snyk, and npm audit, but distrust arises from false positives and low-priority noise. Recommended fixes: tools must show affected components, suggest fixed versions and whether updates are breaking, and help locate or propose alternative libraries; many teams backport fixes and submit PRs themselves.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 0:38The story of Equifax
- 4:42Selection of new dependencies
- 10:12Dependency management tools
- 14:18Main takeaways
- 17:22Tools
- 19:12Developers perception
- 21:57Dependency bot
- 23:32Vulnerability fixes
- 24:32Unit test coverage
related talks
42mSponsored Session: Dependencies: Do's and Don'ts
05mDependency Demons
37mKeep Your Dependencies in Check
40mDependency Management: The Cause of—and Solution to—All Supply...
30mDependency management: the cause of—and solution to—all supply chain problems
38mDependency Management: The Cause of—and Solution to—All Supply...
16mDependency Hell Just Froze Over
29mDependency Management: Risk vs Crisis Management