Keep your dependencies in check

If Log4Shell, Spring4Shell, etc. have taught us anything, it’s that we need to keep our dependencies up to date. But updating our applications can take a lot of time. How do we stay on top of that, while also continuing to deliver business value?

Luckily, there are plenty of tools that can help us with this, from package managers to bots that can automatically create changes on our repositories. Let’s go over some of the different options, so we can make informed choices about what’s best for us in a particular situation.

Transcript

1. Keep your dependencies in check All Day DevOps - Oct 26, 2023 https://maritvandijk.com/ @MaritvanDijk77
2. @MaritvanDijk77
3. @MaritvanDijk77
4. @MaritvanDijk77
5. @MaritvanDijk77
6. Dec. 2021 @MaritvanDijk77
7. @MaritvanDijk77
8. @MaritvanDijk77
9. @MaritvanDijk77
10. March 2022 @MaritvanDijk77
11. @MaritvanDijk77
12. @MaritvanDijk77 Do we need this dependency? https://maritvandijk.com/selecting-dependencies/
13. @MaritvanDijk77 https://www.sonatype.com/resources/log4j-vulnerability-resource-center
14. No dependencies @MaritvanDijk77 Maintain dependencies
15. Maven • Overview of dependencies: `mvn dependency:tree` @MaritvanDijk77
16. Maven • Check for updates: `mvn versions:display-dependency-updates` @MaritvanDijk77
17. Maven • Check for updates: `mvn versions:display-dependency-updates` @MaritvanDijk77
18. Maven • Analyze dependencies: `mvn dependency:analyze` @MaritvanDijk77
19. Gradle • Overview of dependencies: `./gradlew dependencies` @MaritvanDijk77
20. Gradle • Check for updates: • Add plugin, e.g. gradle-versions-plugin • Run `./gradlew dependencyUpdates` @MaritvanDijk77 https://github.com/ben-manes/gradle-versions-plugin
21. Gradle • Analyze dependencies • Add plugin (e.g. nebula) @MaritvanDijk77 https://github.com/nebula-plugins/gradle-lint-plugin/wiki/Unused-Dependency-Rule
22. Gradle • Analyze dependencies • Add plugin (e.g. nebula) • Run `./gradlew fixGradleLint` @MaritvanDijk77 https://github.com/nebula-plugins/gradle-lint-plugin/wiki/Unused-Dependency-Rule
23. IntelliJ IDEA: View Dependencies @MaritvanDijk77
24. IntelliJ IDEA: View Dependencies @MaritvanDijk77
25. IntelliJ IDEA: View Dependencies @MaritvanDijk77
26. IntelliJ IDEA: View Dependencies @MaritvanDijk77 https://www.jetbrains.com/help/idea/maven-projects-tool-window.html
27. IntelliJ IDEA: View Dependencies @MaritvanDijk77 https://www.jetbrains.com/help/idea/jetgradle-tool-window.html
28. IntelliJ IDEA: Dependency Analyzer @MaritvanDijk77 https://www.jetbrains.com/help/idea/work-with-maven-dependencies.html#dependency_analyzer
29. IntelliJ IDEA: Dependency Analyzer @MaritvanDijk77 https://www.jetbrains.com/help/idea/work-with-maven-dependencies.html#dependency_analyzer
30. IntelliJ IDEA: Dependency Analyzer @MaritvanDijk77 https://www.jetbrains.com/help/idea/work-with-gradle-dependency-diagram.html#dependency_analyzer
31. IntelliJ IDEA: Dependency Analyzer @MaritvanDijk77 https://www.jetbrains.com/help/idea/work-with-gradle-dependency-diagram.html#dependency_analyzer
32. IntelliJ IDEA: Dependency Analyzer @MaritvanDijk77 https://www.jetbrains.com/help/idea/work-with-gradle-dependency-diagram.html#dependency_analyzer
33. IntelliJ IDEA: Dependency Analyzer @MaritvanDijk77 https://www.jetbrains.com/help/idea/work-with-gradle-dependency-diagram.html#dependency_analyzer
34. IntelliJ IDEA • Package Search: Add dependency @MaritvanDijk77 https://www.jetbrains.com/help/idea/package-search.html
35. IntelliJ IDEA • Package Search: Add dependency @MaritvanDijk77 https://www.jetbrains.com/help/idea/package-search.html
36. IntelliJ IDEA: Update dependencies • Context Actions (⌥ ⏎ or Alt+Enter) @MaritvanDijk77
37. IntelliJ IDEA: Update dependencies • Hover @MaritvanDijk77 https://www.jetbrains.com/help/idea/package-analysis.html
38. IntelliJ IDEA • Dependencies tool window @MaritvanDijk77 https://www.jetbrains.com/help/idea/package-search.html
39. IntelliJ IDEA • Dependencies tool window (search) @MaritvanDijk77 https://www.jetbrains.com/help/idea/package-search.html
40. IntelliJ IDEA https://www.jetbrains.com/help/idea/package-analysis.html @MaritvanDijk77
41. Pros & Cons + Check dependencies while working on the project - Check out each individual project - Apply & verify updates @MaritvanDijk77
42. Software Composition Analysis (SCA) • Scan all repos (and containers) • Overview @MaritvanDijk77
43. SCA: Pros & Cons + No need to check out repos individually - I have to check the dashboard - Apply & verify updates @MaritvanDijk77
44. @MaritvanDijk77 Bots • Dependabot • Renovate • Snyk Open Source
45. Dependabot • GitHub native • Features: • Alerts • Security updates • Version updates @MaritvanDijk77
46. Dependabot enable @MaritvanDijk77
47. Dependabot alerts @MaritvanDijk77 https://docs.github.com/en/code-security/dependabot/dependabot-alerts/about-dependabot-alerts
48. Dependabot alerts @MaritvanDijk77 https://docs.github.com/en/code-security/dependabot/dependabot-alerts/about-dependabot-alerts
49. Dependabot security updates @MaritvanDijk77 https://docs.github.com/en/code-security/dependabot/dependabot-security-updates/about-dependabot-security-updates
50. Dependabot version updates • Add dependabot.yml • Specify: • Package manager & location of manifest file • Schedule interval (daily, weekly, or monthly) • Optional: • Max. number of PR's (default 5) • Rebase strategy • Etc @MaritvanDijk77 https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/about-dependabot-version-updates
51. Dependabot: Supported platforms • GitHub native • Can run on GitLab too @MaritvanDijk77
52. Renovate • Available via GitHub App • Features: • Security updates • Version updates • Project dashboard @MaritvanDijk77
53. Renovate enable @MaritvanDijk77 https://github.com/apps/renovate
54. Renovate enable - 3 @MaritvanDijk77
55. Renovate onboarding PR @MaritvanDijk77
56. Renovate configuration • All repos or selected repos • Config file is created for you • Scheduling • Max. number of PR's / concurrent branches • Rule based auto merge • More options & more fine-grained @MaritvanDijk77 https://docs.renovatebot.com/configuration-options/
57. Renovate PR @MaritvanDijk77 https://docs.renovatebot.com/merge-confidence/
58. Renovate Dashboard: Project @MaritvanDijk77
59. Renovate: Supported platforms • GitHub (.com and Enterprise Server) • GitLab (.com and CE/EE) • Bitbucket Cloud • Bitbucket Server • Azure DevOps • AWS CodeCommit • Gitea and Forgejo @MaritvanDijk77 https://docs.renovatebot.com/#supported-platforms
60. Snyk Open Source • Available via Snyk • Features: • Security updates • Version updates • Dashboards • Test for new vulnerabilities (on PRs) • Test for vulnerabilities in source code @MaritvanDijk77 https://snyk.io/
61. Snyk enable @MaritvanDijk77 https://snyk.io/
62. Snyk enable @MaritvanDijk77 https://snyk.io/
63. Snyk enable @MaritvanDijk77 https://snyk.io/
64. Snyk enable @MaritvanDijk77 https://snyk.io/
65. Snyk enable @MaritvanDijk77 https://snyk.io/
66. Snyk PR @MaritvanDijk77
67. Snyk PR @MaritvanDijk77
68. Snyk PR Check @MaritvanDijk77
69. Snyk dashboard @MaritvanDijk77
70. Snyk Open Source Configuration • Frequency (daily, weekly, never) • Enable/disable: New and/or known vulnerabilities • Enable/disable PR's for single project @MaritvanDijk77 https://docs.snyk.io/products/snyk-open-source/open-source-basics
71. Snyk Open Source: Supported Platforms • GitHub • GitHub Enterprise • GitHub Read-only projects • Bitbucket Cloud Personal Access Token (Legacy) • Bitbucket Cloud App • Bitbucket Data Center/Server • GitLab • Azure (TFS) Repos @MaritvanDijk77 https://docs.snyk.io/integrations/git-repository-scm-integrations
72. @MaritvanDijk77 Bots • Dependabot • Renovate • Snyk Open Source
73. Bots: Pros & Cons + Relatively easy to install + Automatic PR's - Can create "noise" - Manage PRs (merge & deploy) - Do NOT update your code (if needed) @MaritvanDijk77
74. Migration tools @MaritvanDijk77
75. IntelliJ IDEA • Refactor > Migrate Packages and Classes @MaritvanDijk77 https://www.jetbrains.com/help/idea/migrate.html
76. IntelliJ IDEA • Refactor > Migrate Packages and Classes > • Java EE to Jakarta EE • JUnit (4.x -> 5.0) • JavaFX (8 -> 9) @MaritvanDijk77 https://www.jetbrains.com/help/idea/migrate.html
77. IntelliJ IDEA • Create New Migration @MaritvanDijk77
78. IntelliJ IDEA • Create New Migration @MaritvanDijk77
79. Error Prone • Static analysis tool for Java to catch common programming mistakes at compile-time. • Maven, Gradle, etc. • IntelliJ IDEA / Eclipse plugin, Command line • Bug patterns • Report or fix • Custom checks • Includes Refaster: refactor code using before-and-after templates @MaritvanDijk77 https://errorprone.info/
80. Error Prone @MaritvanDijk77 https://www.youtube.com/watch?v=NPuLeoIzIR0
81. Error Prone Support @MaritvanDijk77 https://error-prone.picnic.tech/
82. OpenRewrite • Source code refactoring for framework/API migrations, vulnerability patches, and static code analysis fixes • Java, Kotlin & Groovy support • Maven/Gradle • Run without a build tool • Early support for Python, Typescript, ... @MaritvanDijk77 https://docs.openrewrite.org/
83. OpenRewrite • Existing recipes • Upgrade versions • Migrate libraries • Fix static analysis issues @MaritvanDijk77 https://docs.openrewrite.org/running-recipes/popular-recipe-guides
84. OpenRewrite • Existing recipes • Find by topic @MaritvanDijk77 https://docs.openrewrite.org/reference/recipes
85. OpenRewrite • Existing recipes • Can author your own recipes @MaritvanDijk77 https://docs.openrewrite.org/
86. OpenRewrite @MaritvanDijk77 https://www.youtube.com/watch?v=jOFfCAleUI8
87. Conclusion •(Re)evaluate dependencies carefully •Automate checks & updates •Stay safe! @MaritvanDijk77
88. Slides & More https://maritvandijk.com/presentations/keep-your-dependencies-in-check/ @MaritvanDijk77