Keep your dependencies in check

If Log4Shell, Spring4Shell, etc. have taught us anything, it’s that we need to keep our dependencies up to date. But updating our applications can take a lot of time. How do we stay on top of that, while also continuing to deliver business value?

Luckily, there are plenty of tools that can help us with this, from package managers to bots that can automatically create changes on our repositories. Let’s go over some of the different options, so we can make informed choices about what’s best for us in a particular situation.

Transcript

1. Keep your dependencies in check Rabobank - Dec 19, 2023 https://maritvandijk.com/
6. Dec. 2021
10. March 2022
15. Do we need this dependency? https://maritvandijk.com/selecting-dependencies/
16. Selecting dependencies
17. Selecting dependencies
18. https://xkcd.com/2347/
19. Selecting dependencies
20. Selecting dependencies
21. Selecting dependencies
22. Selecting dependencies
23. https://www.sonatype.com/resources/log4j-vulnerability-resource-center
24. Find information
25. Dependency information https://search.maven.org/
26. Dependency information https://central.sonatype.com/
27. Dependency information https://search.maven.org/ -> https://central.sonatype.com/
28. Dependency information https://search.maven.org/artifact/com.fasterxml.jackson.core/jackson-databind/2.15.2/jar
29. Dependency information https://central.sonatype.com/artifact/com.fasterxml.jackson.core/jackson-databind
30. Dependency information
31. Dependency information
32. Dependency information https://package-search.jetbrains.com/
33. Dependency information https://package-search.jetbrains.com/
34. Dependency information https://package-search.jetbrains.com/
35. Dependency information https://github.com/
36. Dependency information https://github.com/
37. Dependency information https://github.com/
38. https://maritvandijk.com/presentations/collaborating-on-open-source-software/
39. No dependencies Maintain dependencies
40. Maven • Overview of dependencies: `mvn dependency:tree`
41. Maven • Check for updates: `mvn versions:display-dependency-updates`
42. Maven • Check for updates: `mvn versions:display-dependency-updates`
43. Maven • Analyze dependencies: `mvn dependency:analyze`
44. Gradle • Overview of dependencies: `./gradlew dependencies`
45. Gradle • Check for updates: • Add plugin, e.g. gradle-versions-plugin • Run `./gradlew dependencyUpdates` https://github.com/ben-manes/gradle-versions-plugin
46. Gradle • Analyze dependencies • Add plugin (e.g. nebula) https://github.com/nebula-plugins/gradle-lint-plugin/wiki/Unused-Dependency-Rule
47. Gradle • Analyze dependencies • Add plugin (e.g. nebula) • Run `./gradlew fixGradleLint` https://github.com/nebula-plugins/gradle-lint-plugin/wiki/Unused-Dependency-Rule
48. IntelliJ IDEA: View Dependencies
49. IntelliJ IDEA: View Dependencies
50. IntelliJ IDEA: View Dependencies
51. IntelliJ IDEA: View Dependencies https://www.jetbrains.com/help/idea/maven-projects-tool-window.html
52. IntelliJ IDEA: View Dependencies https://www.jetbrains.com/help/idea/jetgradle-tool-window.html
53. IntelliJ IDEA: Dependency Analyzer https://www.jetbrains.com/help/idea/work-with-maven-dependencies.html#dependency_analyzer
54. IntelliJ IDEA: Dependency Analyzer https://www.jetbrains.com/help/idea/work-with-maven-dependencies.html#dependency_analyzer
55. IntelliJ IDEA: Dependency Analyzer https://www.jetbrains.com/help/idea/work-with-gradle-dependency-diagram.html#dependency_analyzer
56. IntelliJ IDEA: Dependency Analyzer https://www.jetbrains.com/help/idea/work-with-gradle-dependency-diagram.html#dependency_analyzer
57. IntelliJ IDEA: Dependency Analyzer https://www.jetbrains.com/help/idea/work-with-gradle-dependency-diagram.html#dependency_analyzer
58. IntelliJ IDEA: Dependency Analyzer https://www.jetbrains.com/help/idea/work-with-gradle-dependency-diagram.html#dependency_analyzer
59. IntelliJ IDEA: Package Search https://www.jetbrains.com/help/idea/package-search.html
60. IntelliJ IDEA • Package Search: Add dependency https://www.jetbrains.com/help/idea/package-search.html
61. IntelliJ IDEA • Package Search: Add dependency https://www.jetbrains.com/help/idea/package-search.html
62. IntelliJ IDEA • Package Search: Add dependency https://www.jetbrains.com/help/idea/package-search.html
63. IntelliJ IDEA: Update dependencies • Hover https://www.jetbrains.com/help/idea/package-analysis.html
64. IntelliJ IDEA: Update dependencies • Context Actions (⌥ ⏎ or Alt+Enter)
65. IntelliJ IDEA • Dependencies tool window https://www.jetbrains.com/help/idea/package-search.html
66. IntelliJ IDEA • Dependencies tool window (search) https://www.jetbrains.com/help/idea/package-search.html
67. IntelliJ IDEA https://www.jetbrains.com/help/idea/package-analysis.html • Vulnerable Dependencies
68. IntelliJ IDEA • Vulnerable Path / Exploitable Path
69. IntelliJ IDEA • Vulnerable Path / Exploitable Path
70. IntelliJ IDEA • Vulnerable Path / Exploitable Path
71. IntelliJ IDEA • Vulnerable Path / Exploitable Path
72. IntelliJ IDEA • Vulnerable Path / Exploitable Path
73. Pros & Cons + Check dependencies while working on the project - Check out each individual project - Apply & verify updates
74. Software Composition Analysis (SCA) • Scan all repos (and containers) • Overview
75. SCA: Pros & Cons + No need to check out repos individually - I have to check the dashboard - Apply & verify updates
76. Bots • Dependabot • Renovate • Snyk Open Source
77. Dependabot • GitHub native • Features: • Alerts • Security updates • Version updates
78. Dependabot enable
79. Dependabot alerts https://docs.github.com/en/code-security/dependabot/dependabot-alerts/about-dependabot-alerts
80. Dependabot alerts https://docs.github.com/en/code-security/dependabot/dependabot-alerts/about-dependabot-alerts
81. Dependabot security updates https://docs.github.com/en/code-security/dependabot/dependabot-security-updates/about-dependabot-security-updates
82. Dependabot version updates • Add dependabot.yml • Specify: • Package manager & location of manifest file • Schedule interval (daily, weekly, or monthly) • Optional: • Max. number of PR's (default 5) • Rebase strategy • Etc https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/about-dependabot-version-updates
83. Dependabot: Supported platforms • GitHub native • Can run on GitLab too
84. Renovate • Available via GitHub App • Features: • Security updates • Version updates • Project dashboard
85. Renovate enable https://github.com/apps/renovate
86. Renovate enable - 3
87. Renovate onboarding PR
88. Renovate configuration • All repos or selected repos • Config file is created for you • Scheduling • Max. number of PR's / concurrent branches • Rule based auto merge • More options & more fine-grained https://docs.renovatebot.com/configuration-options/
89. Renovate PR https://docs.renovatebot.com/merge-confidence/
90. Renovate Dashboard: Project
91. Renovate: Supported platforms • GitHub (.com and Enterprise Server) • GitLab (.com and CE/EE) • Bitbucket Cloud • Bitbucket Server • Azure DevOps • AWS CodeCommit • Gitea and Forgejo https://docs.renovatebot.com/#supported-platforms
92. Snyk Open Source • Available via Snyk • Features: • Security updates • Version updates • Dashboards • Test for new vulnerabilities (on PRs) • Test for vulnerabilities in source code https://snyk.io/
93. Snyk enable https://snyk.io/
94. Snyk enable https://snyk.io/
95. Snyk enable https://snyk.io/
96. Snyk enable https://snyk.io/
97. Snyk enable https://snyk.io/
98. Snyk PR
99. Snyk PR
100. Snyk PR Check
101. Snyk dashboard
102. Snyk Open Source Configuration • Frequency (daily, weekly, never) • Enable/disable: New and/or known vulnerabilities • Enable/disable PR's for single project https://docs.snyk.io/products/snyk-open-source/open-source-basics
103. Snyk Open Source: Supported Platforms • GitHub • GitHub Enterprise • GitHub Read-only projects • Bitbucket Cloud Personal Access Token (Legacy) • Bitbucket Cloud App • Bitbucket Data Center/Server • GitLab • Azure (TFS) Repos https://docs.snyk.io/integrations/git-repository-scm-integrations
104. Bots • Dependabot • Renovate • Snyk Open Source
105. Bots: Pros & Cons + Relatively easy to install + Automatic PR's - Can create "noise" - Manage PRs (merge & deploy) - Do NOT update your code (if needed)
106. Migration tools
107. IntelliJ IDEA • Refactor > Migrate Packages and Classes https://www.jetbrains.com/help/idea/migrate.html
108. IntelliJ IDEA • Refactor > Migrate Packages and Classes > • Java EE to Jakarta EE • JUnit (4.x -> 5.0) • JavaFX (8 -> 9) https://www.jetbrains.com/help/idea/migrate.html
109. IntelliJ IDEA • Create New Migration
110. IntelliJ IDEA • Create New Migration
111. Error Prone • Static analysis tool for Java to catch common programming mistakes at compile-time. • Maven, Gradle, etc. • IntelliJ IDEA / Eclipse plugin, Command line • Bug patterns • Report or fix • Custom checks • Includes Refaster: refactor code using before-and-after templates https://errorprone.info/
112. Error Prone https://www.youtube.com/watch?v=NPuLeoIzIR0
113. Error Prone Support https://error-prone.picnic.tech/
114. OpenRewrite • Source code refactoring for framework/API migrations, vulnerability patches, and static code analysis fixes • Java, Kotlin & Groovy support • Maven/Gradle • Run without a build tool • Early support for Python, Typescript, ... https://docs.openrewrite.org/
115. OpenRewrite • Existing recipes • Upgrade versions • Migrate libraries • Fix static analysis issues https://docs.openrewrite.org/running-recipes/popular-recipe-guides
116. OpenRewrite • Existing recipes • Find by topic https://docs.openrewrite.org/reference/recipes
117. OpenRewrite • Existing recipes • Can author your own recipes https://docs.openrewrite.org/
118. OpenRewrite https://www.youtube.com/watch?v=jOFfCAleUI8
119. Conclusion •(Re)evaluate dependencies carefully •Use the tools you have! •Automate checks & updates as much as possible •Stay safe!
120. Slides & More https://maritvandijk.com/presentations/keep-your-dependencies-in-check/