Dependency Management: The Cause of—and Solution to—All Supply Chain Problems
Talkat Open Source Summit Europe 2023 · on Thursday, 2023-09-21· at 12:50· Room 0C (Floor 0), Abandoibarra Etorb., 4, 48011 Bilbao, Bizkaia, Spain·
summary
Shows that dependency resolution is NP‑complete, demonstrates resolvers by reimplementing real bugs and even using 9x9 Sudoku as a test case, and delivers concrete metrics: deps.dev finds about 10% of package versions change daily and up to 20% of PyPI packages change their dependency graphs multiple times per week. Explains how npm’s latest‑match and Maven’s pinned defaults alter remediation speed, describes tools (OSV Scanner, Scorecard, depths.dev API and BigQuery) used to detect and fix issues.
AI-written summary · about
chapters (7)
- 0:00Dependency management challenges
- 1:44Dependency resolution algorithms
- 12:38Why dependency graphs change
- 20:47Indirect dependency issues
- 26:25Indirect vulnerability remediation
- 33:29Scalable dependency tools
- 37:22Key takeaways
related talks
38mDependency Management: The Cause of—and Solution to—All Supply...
30mDependency management: the cause of—and solution to—all supply chain problems
40mDependency Management: The Cause of—and Solution to—All Supply...
46mNavigating the Dependency Management Maze
42mSponsored Session: Dependencies: Do's and Don'ts
05mDependency Demons
29mDependency Management: Risk vs Crisis Management
24mDependency Track Fortifying The Supply Chain