Sponsored Session: Dependencies: Do's and Don'ts
summary
A practical framework called the dependency management sandwich breaks dependency work into visibility (including Docker images, infra, internal code), locking/pinning, SBOMs, prioritization beyond CVSS, and automation. Empirical claim: npm analysis shows a fix exists same day in 90% of disclosed cases, so staying current prevents many incidents. Recommended tooling and practices include automated updates (example: renovate bot), exploitability scoring, and legal checks—one M&A case forces a $4M escrow and $500k remediation bill.
AI-written summary · about
chapters (11)
- 0:00Start
- 0:48Transparency
- 1:44Rhys Harkins
- 5:01Pinning Dependencies
- 13:10Business Risk and Exploitability
- 13:57Exploitability
- 14:58Reachability
- 25:26Benefits of up-to-Date Dependencies
- 27:05Crowd Testing
- 27:28Crowd Adoption
- 33:18Automation
related talks
46mNavigating the Dependency Management Maze
27mDependency hell - Or, Developers' perception of software dependencies
40mDependency Management: The Cause of—and Solution to—All Supply...
51mOSS Supply Chain Threats and Why You Need a Holistic Security Strategy
29mDependency Management: Risk vs Crisis Management
38mDependency Management: The Cause of—and Solution to—All Supply Chain Problems
13mManaging Vulnerabilities in Open-Source Dependencies
25mThe node_modules Iceberg: Mysteries Below the Waterline