Keep your dependencies in check

If Log4Shell, Spring4Shell, etc. have taught us anything, it’s that we need to keep our dependencies up to date. But updating our applications can take a lot of time. How do we stay on top of that, while also continuing to deliver business value?

Luckily, there are plenty of tools that can help us with this, from package managers to bots that can automatically create changes on our repositories. Let’s go over some of the different options, so we can make informed choices about what’s best for us in a particular situation.

Transcript

1. Keep your dependencies in check JFall - November 4th, 2022 https://maritvandijk.com/ @MaritvanDijk77
2. @MaritvanDijk77
3. @MaritvanDijk77
4. @MaritvanDijk77
5. @MaritvanDijk77
6. Dec. 2021 @MaritvanDijk77
7. @MaritvanDijk77
8. @MaritvanDijk77
9. @MaritvanDijk77
10. March 2022 @MaritvanDijk77
11. @MaritvanDijk77
12. @MaritvanDijk77
13. @MaritvanDijk77
14. @MaritvanDijk77
15. @MaritvanDijk77 Do we need this dependency?
16. Selecting dependencies @MaritvanDijk77
17. Selecting dependencies @MaritvanDijk77
18. @MaritvanDijk77 https://xkcd.com/2347/
19. Selecting dependencies @MaritvanDijk77
20. Selecting dependencies @MaritvanDijk77
21. Selecting dependencies @MaritvanDijk77
22. Selecting dependencies @MaritvanDijk77
23. @MaritvanDijk77 Find information
24. Dependency information @MaritvanDijk77 https://mvnrepository.com/
25. Dependency information @MaritvanDijk77 https://mvnrepository.com/
26. Dependency information @MaritvanDijk77 https://github.com/
27. Dependency information @MaritvanDijk77 https://github.com/
28. Dependency information @MaritvanDijk77 https://package-search.jetbrains.com/
29. Dependency information @MaritvanDijk77 https://package-search.jetbrains.com/
30. Dependency information @MaritvanDijk77 https://package-search.jetbrains.com/
31. No dependencies @MaritvanDijk77 Maintain dependencies
32. Maven • Overview of dependencies: `mvn dependency:tree` @MaritvanDijk77
33. Maven • Check for updates: `mvn versions:display-dependency-updates` @MaritvanDijk77
34. Maven • Analyse dependencies: `mvn dependency:analyze` @MaritvanDijk77
35. Gradle • Overview of dependencies: `./gradlew dependencies` @MaritvanDijk77
36. Gradle • Add plugin, e.g. gradle-versions-plugin • Run `./gradlew dependencyUpdates` @MaritvanDijk77
37. IntelliJ IDEA • Package Search: Add dependency @MaritvanDijk77 https://www.jetbrains.com/help/idea/package-search.html
38. IntelliJ IDEA • Package Search: Add dependency @MaritvanDijk77 https://www.jetbrains.com/help/idea/package-search.html
39. IntelliJ IDEA • Intention actions (⌥ ⏎ or Alt+Enter) @MaritvanDijk77 https://www.jetbrains.com/help/idea/package-search.html
40. IntelliJ IDEA • Intention actions (⌥ ⏎ or Alt+Enter) @MaritvanDijk77 https://www.jetbrains.com/help/idea/package-search.html
41. IntelliJ IDEA • Package search: Dependencies tool window @MaritvanDijk77 https://www.jetbrains.com/help/idea/package-search.html
42. IntelliJ IDEA • Package search: Dependencies tool window @MaritvanDijk77 https://www.jetbrains.com/help/idea/package-search.html
43. IntelliJ IDEA: Ultimate Edition @MaritvanDijk77 • Package Checker
44. Downsides - Check out each individual project - Apply & verify updates @MaritvanDijk77
45. Software Composition Analysis (SCA) • Scan all repos (and containers) • Overview @MaritvanDijk77
46. SCA: Pros & Cons + No need to check out repos individually - I have to check the dashboard @MaritvanDijk77
47. @MaritvanDijk77 Bots • Dependabot • Renovate • Snyk Open Source
48. Dependabot • GitHub native • Features: • Alerts • Security updates • Version updates @MaritvanDijk77
49. Dependabot enable @MaritvanDijk77
50. Dependabot alerts @MaritvanDijk77
51. Dependabot security updates @MaritvanDijk77
52. Dependabot version updates • Add dependabot.yml (impacts security updates) • Package manager & directory manifest file • Frequency (daily, weekly, or monthly) • Schedule (date, time, timezone) • Max. number of PR's (default 5) • Some details to manage PR's @MaritvanDijk77 https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
53. Renovate • Available via GitHub App • Features: • Security updates • Project dashboard @MaritvanDijk77
54. Renovate enable @MaritvanDijk77 https://github.com/apps/renovate
55. Renovate enable @MaritvanDijk77
56. Renovate enable @MaritvanDijk77
57. Renovate configuration • All repos or selected repos • Config file is created for you • Max. number of PR's / concurrent branches • More options • More fine-grained @MaritvanDijk77 https://docs.renovatebot.com/configuration-options/
58. Renovate PR @MaritvanDijk77 https://docs.renovatebot.com/merge-confidence/
59. Renovate Dashboard @MaritvanDijk77
60. Snyk Open Source • Available via Snyk • Features: • Security updates • Version updates • Test for new vulnerabilities (on PRs) • Test for vulnerabilities in source code • Dashboards @MaritvanDijk77 https://snyk.io/
61. Snyk enable @MaritvanDijk77 https://snyk.io/
62. Snyk enable @MaritvanDijk77
63. Snyk enable @MaritvanDijk77
64. Snyk enable @MaritvanDijk77
65. Snyk PR @MaritvanDijk77
66. Snyk PR @MaritvanDijk77
67. Snyk PR Check @MaritvanDijk77
68. Snyk dashboard @MaritvanDijk77
69. Snyk Open Source Configuration • Frequency (daily, weekly, never) • Enable/disable: New and/or known vulnerabilities • Enable/disable PR's for single project @MaritvanDijk77 https://docs.snyk.io/products/snyk-open-source/open-source-basics
70. Bots: Pros & Cons + Relatively easy to install + Automatic PR's - Can create "noise" - Manage PRs (merge & deploy) - No code changes (if needed) @MaritvanDijk77
71. Migration tools @MaritvanDijk77
72. IntelliJ IDEA • Migrate Packages and Classes @MaritvanDijk77 https://www.jetbrains.com/help/idea/migrate.html
73. IntelliJ IDEA • Create New Migration @MaritvanDijk77
74. IntelliJ IDEA • Create New Migration @MaritvanDijk77
75. Error Prone • Static analysis tool for Java that catches common programming mistakes at compile-time. • Maven, Gradle, etc. • IntelliJ IDEA / Eclipse plugin, Command line • Bug patterns • Report or fix • Custom checks • Includes Refaster: refactor code using before-and-after templates @MaritvanDijk77 https://errorprone.info/
76. Error Prone @MaritvanDijk77 https://www.youtube.com/watch?v=NPuLeoIzIR0
77. OpenRewrite • Source code refactoring for framework migrations, vulnerability patches, and API migrations • Early focus on Java • Maven & Gradle • Existing recipes • Can author recipes @MaritvanDijk77 https://docs.openrewrite.org/
78. Quickstart: Maven and Gradle • Add plugin: @MaritvanDijk77 https://docs.openrewrite.org/getting-started/getting-started
79. @MaritvanDijk77 https://docs.openrewrite.org/getting-started/getting-started • Discover: `./mvnw rewrite:discover`
80. Quickstart: Maven and Gradle • Configure plugin: @MaritvanDijk77 https://docs.openrewrite.org/getting-started/getting-started
81. @MaritvanDijk77 https://docs.openrewrite.org/getting-started/getting-started • Run: `./mvnw rewrite:run`
82. Quickstart: Maven and Gradle @MaritvanDijk77 https://docs.openrewrite.org/getting-started/getting-started
83. Quickstart: Maven and Gradle @MaritvanDijk77 https://docs.openrewrite.org/getting-started/getting-started
84. OpenRewrite @MaritvanDijk77 https://www.youtube.com/watch?v=7fslFKkCkxg
85. Conclusion •(Re)evaluate dependencies carefully •Automate checks & updates •Stay safe! @MaritvanDijk77
86. Slides https://maritvandijk.com/presentations/keep-your-dependencies-in-check/ @MaritvanDijk77