Dependency Management: The Cause of—and Solution to—All Supply...
summary
Claims that dependency resolution is NP‑complete, and that Google built deps.dev and reimplemented resolvers (including a 9x9 Sudoku test) to study real graphs. Finds up to 20% of PyPI package versions change graphs multiple times per week, ~10% of package versions in several ecosystems change daily, 98% of vulnerability hits are indirect, and npm uses open requirements for ~74% of deps. Recommends OSV Scanner, Scorecard, the deps.dev API and BigQuery to continuously scan and remediate at scale.
AI-written summary · about
chapters (7)
- 0:00Dependency management challenges
- 1:44Dependency resolution algorithms
- 12:38Why dependency graphs change
- 20:47Indirect dependency issues
- 26:25Indirect vulnerability remediation
- 33:29Scalable dependency tools
- 37:22Key takeaways
related talks
38mDependency Management: The Cause of—and Solution to—All Supply Chain Problems
30mDependency management: the cause of—and solution to—all supply chain problems
40mDependency Management: The Cause of—and Solution to—All Supply...
27mDependency hell - Or, Developers' perception of software dependencies
46mNavigating the Dependency Management Maze
42mSponsored Session: Dependencies: Do's and Don'ts
39mTrials and Tribulations of Updating Dependencies for Vulnerability...
29mMyths developers believe about open source security