Keep Your Dependencies in Check
Talkat JCON Europe 2023 · on Tuesday, 2023-06-20· at 13:00· Cinema 6, Im Mediapark 1, 50670 Köln, Germany·
summary
Shows that keeping dependencies current is practical but messy: uses Maven/Gradle dependency trees and IntelliJ’s vuln checks to find issues, then drives updates with Dependabot, Renovate, or Snyk (Dependabot is GitHub-native, Renovate offers fine-grained dashboards and confidence scores, Snyk bundles related PRs and checks incoming PRs). Notes microservice fleets of ~5–10 services per team, a surprising 33% of downloads still fetch vulnerable Log4j versions, and warns auto-PRs and green builds sometimes still break runtime behavior (example: Failsafe integration).
AI-written summary · about
chapters (13)
- 0:00Introduction and context
- 3:04Dependency management trade-offs
- 7:20Evaluating dependencies wisely
- 11:17Tools to track dependencies
- 14:12Viewing dependencies in IDE
- 17:04Adding dependencies safely
- 19:34Checking vulnerabilities in IDE
- 21:38IDE limitations and SCA tools
- 23:03Automated dependency bots
- 28:01Renovate vs Dependabot vs Snyk
- 31:50Migration tools and refactoring
- 34:15OpenRewrite for code fixes
- 35:38Summary and takeaways
related talks
31mKeep your dependencies in check
33mKeep your dependencies in check
38mKnow thy neighbours: dependency management done right.
26mKnow Your Dependencies: A Guide to Automating Dependency Assurance
27mDependency hell - Or, Developers' perception of software dependencies
42mDependency Updates: Before and After
29mDependency Management: Where the Fork are We?
40mDependency Management: The Cause of—and Solution to—All Supply...