Beyond "Just Update All the Things": Uncovering the Nuances of Dependency Se... Rex Pan & Holly Gong
Beyond "Just Update All the Things": Uncovering the Nuances of Dependency Security - Rex Pan & Holly Gong, Google
Keeping your project's dependencies safe from vulnerabilities sounds deceptively simple – just update everything, right? In reality, breaking changes, overwhelming maintenance burdens, and the complexities of modern software ecosystems turn this into a major challenge. Running vulnerability scanners often floods you with false positives, while pinpointing vulnerable versions and navigating intricate dependency structures make upgrades a headache. This talk unravels the hidden complexities of dependency management, including differing ecosystem rules and tool/spec mismatches. We'll examine how the OSV project (OSV Schema, OSV.dev, OSV-Scanner) tackles these challenges, by taking a developer-centric focus on these problems. Seamless integration into developer workflows is crucial for successful vulnerability management. We'll outline strategies for incorporating dependency awareness and remediation directly into these workflows. Finally, as vulnerabilities extend beyond release, we'll discuss container image scanning to simplify identification and patching within images beyond just trying to update everything within the image.