Keep your dependencies in check

If Log4Shell, Spring4Shell, etc. have taught us anything, it’s that we need to keep our dependencies up to date. But updating our applications can take a lot of time. How do we stay on top of that, while also continuing to deliver business value?

Luckily, there are plenty of tools that can help us with this, from package managers to bots that can automatically create changes on our repositories. Let’s go over some of the different options, so we can make informed choices about what’s best for us in a particular situation.

Transcript

1. Keep your dependencies in check Voxxed Days Zürich - March 16th, 2023 https://maritvandijk.com/ @MaritvanDijk77
2. @MaritvanDijk77
3. @MaritvanDijk77
4. @MaritvanDijk77
5. @MaritvanDijk77
6. Dec. 2021 @MaritvanDijk77
7. @MaritvanDijk77
8. @MaritvanDijk77
9. @MaritvanDijk77
10. March 2022 @MaritvanDijk77
11. @MaritvanDijk77
12. @MaritvanDijk77
13. @MaritvanDijk77
14. @MaritvanDijk77
15. @MaritvanDijk77 Do we need this dependency?
16. Selecting dependencies @MaritvanDijk77
17. Selecting dependencies @MaritvanDijk77
18. @MaritvanDijk77 https://xkcd.com/2347/
19. Selecting dependencies @MaritvanDijk77
20. Selecting dependencies @MaritvanDijk77
21. Selecting dependencies @MaritvanDijk77
22. Selecting dependencies @MaritvanDijk77
23. @MaritvanDijk77 Find information
24. Dependency information @MaritvanDijk77 https://search.maven.org/
25. Dependency information @MaritvanDijk77 https://search.maven.org/
26. Dependency information @MaritvanDijk77
27. Dependency information @MaritvanDijk77
28. Dependency information @MaritvanDijk77 https://package-search.jetbrains.com/
29. Dependency information @MaritvanDijk77 https://package-search.jetbrains.com/
30. Dependency information @MaritvanDijk77 https://package-search.jetbrains.com/
31. Dependency information @MaritvanDijk77 https://github.com/
32. Dependency information @MaritvanDijk77 https://github.com/
33. Dependency information @MaritvanDijk77 https://github.com/
34. No dependencies @MaritvanDijk77 Maintain dependencies
35. Maven • Overview of dependencies: `mvn dependency:tree` @MaritvanDijk77
36. Maven • Check for updates: `mvn versions:display-dependency-updates` @MaritvanDijk77
37. Maven • Analyze dependencies: `mvn dependency:analyze` @MaritvanDijk77
38. Gradle • Overview of dependencies: `./gradlew dependencies` @MaritvanDijk77
39. Gradle • Add plugin, e.g. gradle-versions-plugin • Run `./gradlew dependencyUpdates` @MaritvanDijk77 https://github.com/ben-manes/gradle-versions-plugin
40. IntelliJ IDEA: View Dependencies @MaritvanDijk77
41. IntelliJ IDEA: View Dependencies @MaritvanDijk77
42. IntelliJ IDEA: View Dependencies @MaritvanDijk77
43. IntelliJ IDEA: View Dependencies @MaritvanDijk77 https://www.jetbrains.com/help/idea/maven-projects-tool-window.html
44. IntelliJ IDEA: View Dependencies @MaritvanDijk77 https://www.jetbrains.com/help/idea/jetgradle-tool-window.html
45. IntelliJ IDEA: Dependency Analyzer @MaritvanDijk77 https://www.jetbrains.com/help/idea/work-with-maven-dependencies.html#dependency_analyzer
46. IntelliJ IDEA: Dependency Analyzer @MaritvanDijk77 https://www.jetbrains.com/help/idea/work-with-maven-dependencies.html#dependency_analyzer
47. IntelliJ IDEA: Dependency Analyzer @MaritvanDijk77 https://www.jetbrains.com/help/idea/work-with-gradle-dependency-diagram.html#dependency_analyzer
48. IntelliJ IDEA: Dependency Analyzer @MaritvanDijk77 https://www.jetbrains.com/help/idea/work-with-gradle-dependency-diagram.html#dependency_analyzer
49. IntelliJ IDEA • Package Search: Add dependency @MaritvanDijk77 https://www.jetbrains.com/help/idea/package-search.html
50. IntelliJ IDEA • Package Search: Add dependency @MaritvanDijk77 https://www.jetbrains.com/help/idea/package-search.html
51. IntelliJ IDEA @MaritvanDijk77 https://www.jetbrains.com/help/idea/package-search.html
52. IntelliJ IDEA: Update dependencies • Context Actions (⌥ ⏎ or Alt+Enter) @MaritvanDijk77 https://www.jetbrains.com/help/idea/package-search.html
53. IntelliJ IDEA: Update dependencies • Hover @MaritvanDijk77 https://www.jetbrains.com/help/idea/package-search.html
54. IntelliJ IDEA: Update dependencies @MaritvanDijk77 https://www.jetbrains.com/help/idea/package-search.html
55. IntelliJ IDEA • Hover (or Context Actions (⌥ ⏎ or Alt+Enter) @MaritvanDijk77 https://www.jetbrains.com/help/idea/package-search.html
56. IntelliJ IDEA • Package search: Dependencies tool window @MaritvanDijk77 https://www.jetbrains.com/help/idea/package-search.html
57. IntelliJ IDEA • Package search: Dependencies tool window @MaritvanDijk77 https://www.jetbrains.com/help/idea/package-search.html
58. IntelliJ IDEA: Dependency tool window @MaritvanDijk77 https://www.jetbrains.com/help/idea/package-search.html
59. IntelliJ IDEA Ultimate @MaritvanDijk77 • Package Checker https://www.jetbrains.com/help/idea/package-analysis.html
60. IntelliJ IDEA Ultimate: Package checker
61. IntelliJ IDEA Ultimate: Package checker
62. Downsides - Check out each individual project - Apply & verify updates @MaritvanDijk77
63. Software Composition Analysis (SCA) • Scan all repos (and containers) • Overview @MaritvanDijk77
64. SCA: Pros & Cons + No need to check out repos individually - I have to check the dashboard - Apply & verify updates @MaritvanDijk77
65. @MaritvanDijk77 Bots • Dependabot • Renovate • Snyk Open Source
66. Dependabot • GitHub native • Features: • Alerts • Security updates • Version updates @MaritvanDijk77
67. Dependabot enable @MaritvanDijk77
68. Dependabot alerts @MaritvanDijk77 https://docs.github.com/en/code-security/dependabot/dependabot-alerts/about-dependabot-alerts
69. Dependabot alerts @MaritvanDijk77
70. Dependabot security updates @MaritvanDijk77 https://docs.github.com/en/code-security/dependabot/dependabot-security-updates/about-dependabot-security-updates
71. Dependabot version updates • Add dependabot.yml • Specify: • Package manager & location of manifest file • Schedule interval (daily, weekly, or monthly) • Optional: • Max. number of PR's (default 5) • Rebase strategy • Etc @MaritvanDijk77 https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/about-dependabot-version-updates
72. Renovate • Available via GitHub App • Features: • Security updates • Version updates • Project dashboard @MaritvanDijk77
73. Renovate enable @MaritvanDijk77 https://github.com/apps/renovate
74. Renovate enable - 3 @MaritvanDijk77
75. Renovate onboarding PR @MaritvanDijk77
76. Renovate configuration • All repos or selected repos • Config file is created for you • Scheduling • Max. number of PR's / concurrent branches • Rule based auto merge • More options & more fine-grained @MaritvanDijk77 https://docs.renovatebot.com/configuration-options/
77. Renovate PR @MaritvanDijk77 https://docs.renovatebot.com/merge-confidence/
78. Renovate Dashboard: Project @MaritvanDijk77
79. Renovate Dashboard: Jobs @MaritvanDijk77
80. Snyk Open Source • Available via Snyk • Features: • Security updates • Version updates • Test for new vulnerabilities (on PRs) • Test for vulnerabilities in source code • Dashboards @MaritvanDijk77 https://snyk.io/
81. Snyk enable @MaritvanDijk77 https://snyk.io/
82. Snyk enable - 2 @MaritvanDijk77
83. Snyk enable - 3 @MaritvanDijk77
84. Snyk enable - 4 @MaritvanDijk77
85. Snyk PR @MaritvanDijk77
86. Snyk PR @MaritvanDijk77
87. Snyk PR Check @MaritvanDijk77
88. Snyk dashboard @MaritvanDijk77
89. Snyk Open Source Configuration • Frequency (daily, weekly, never) • Enable/disable: New and/or known vulnerabilities • Enable/disable PR's for single project @MaritvanDijk77 https://docs.snyk.io/products/snyk-open-source/open-source-basics
90. Bots: Pros & Cons + Relatively easy to install + Automatic PR's - Can create "noise" - Manage PRs (merge & deploy) - No code changes (if needed) @MaritvanDijk77
91. Migration tools @MaritvanDijk77
92. IntelliJ IDEA • Migrate Packages and Classes @MaritvanDijk77 https://www.jetbrains.com/help/idea/migrate.html
93. IntelliJ IDEA • Create New Migration @MaritvanDijk77
94. IntelliJ IDEA • Create New Migration @MaritvanDijk77
95. IntelliJ IDEA @MaritvanDijk77 https://www.youtube.com/@intellijidea
96. Error Prone • Static analysis tool for Java that catches common programming mistakes at compile-time. • Maven, Gradle, etc. • IntelliJ IDEA / Eclipse plugin, Command line • Bug patterns • Report or fix • Custom checks • Includes Refaster: refactor code using before-and-after templates @MaritvanDijk77 https://errorprone.info/
97. Error Prone @MaritvanDijk77 https://www.youtube.com/watch?v=NPuLeoIzIR0
98. OpenRewrite • Source code refactoring for framework migrations, vulnerability patches, and API migrations • Early focus on Java • Kotlin - early support, actively developed • Groovy - focus on Gradle dependency manipulation, works on most Groovy source code too • Python - in development, not released yet @MaritvanDijk77 https://docs.openrewrite.org/
99. OpenRewrite • Existing recipes @MaritvanDijk77 https://docs.openrewrite.org/running-recipes/popular-recipe-guides
100. OpenRewrite • Existing recipes @MaritvanDijk77 https://docs.openrewrite.org/reference/recipes
101. OpenRewrite • Existing recipes • Can author recipes @MaritvanDijk77 https://docs.openrewrite.org/
102. Quickstart: Maven and Gradle • Add plugin: @MaritvanDijk77 https://docs.openrewrite.org/getting-started/getting-started
103. Quickstart: Maven and Gradle • Activate a recipe: @MaritvanDijk77 https://docs.openrewrite.org/getting-started/getting-started
104. @MaritvanDijk77 https://docs.openrewrite.org/getting-started/getting-started • Run: `./mvnw rewrite:run`
105. Quickstart: Maven and Gradle @MaritvanDijk77 https://docs.openrewrite.org/getting-started/getting-started
106. Quickstart: Maven and Gradle @MaritvanDijk77 https://docs.openrewrite.org/getting-started/getting-started
107. Quickstart: Maven command line @MaritvanDijk77 https://docs.openrewrite.org/reference/recipes/java/cleanup/commonstaticanalysis
108. OpenRewrite @MaritvanDijk77
109. Conclusion •(Re)evaluate dependencies carefully •Automate checks & updates •Stay safe! @MaritvanDijk77
110. Slides & More https://maritvandijk.com/presentations/keep-your-dependencies-in-check/ @MaritvanDijk77