Keep your dependencies in check

If Log4Shell, Spring4Shell, etc. have taught us anything, it’s that we need to keep our dependencies up to date. But updating our applications can take a lot of time. How do we stay on top of that, while also continuing to deliver business value?

Luckily, there are plenty of tools that can help us with this, from package managers to bots that can automatically create changes on our repositories. Let’s go over some of the different options, so we can make informed choices about what’s best for us in a particular situation.

Transcript

1. Keep your dependencies in check JCON - June 20th, 2023 https://maritvandijk.com/ @MaritvanDijk77
2. @MaritvanDijk77
3. @MaritvanDijk77
4. @MaritvanDijk77
5. @MaritvanDijk77
6. Dec. 2021 @MaritvanDijk77
7. @MaritvanDijk77
8. @MaritvanDijk77
9. @MaritvanDijk77
10. March 2022 @MaritvanDijk77
11. @MaritvanDijk77
12. @MaritvanDijk77
13. @MaritvanDijk77
14. @MaritvanDijk77
15. @MaritvanDijk77 Do we need this dependency?
16. Selecting dependencies @MaritvanDijk77
17. Selecting dependencies @MaritvanDijk77
18. @MaritvanDijk77 https://xkcd.com/2347/
19. Selecting dependencies @MaritvanDijk77
20. Selecting dependencies @MaritvanDijk77
21. Selecting dependencies @MaritvanDijk77
22. Selecting dependencies @MaritvanDijk77
23. @MaritvanDijk77 https://www.sonatype.com/resources/log4j-vulnerability-resource-center
24. @MaritvanDijk77 Find information
25. Dependency information @MaritvanDijk77 https://search.maven.org/
26. Dependency information @MaritvanDijk77 https://search.maven.org/
27. Dependency information @MaritvanDijk77
28. Dependency information @MaritvanDijk77
29. Dependency information @MaritvanDijk77 https://package-search.jetbrains.com/
30. Dependency information @MaritvanDijk77 https://package-search.jetbrains.com/
31. Dependency information @MaritvanDijk77 https://package-search.jetbrains.com/
32. Dependency information @MaritvanDijk77 https://github.com/
33. Dependency information @MaritvanDijk77 https://github.com/
34. Dependency information @MaritvanDijk77 https://github.com/
35. @MaritvanDijk77 https://maritvandijk.com/presentations/collaborating-on-open-source-software/
36. No dependencies @MaritvanDijk77 Maintain dependencies
37. Maven • Overview of dependencies: `mvn dependency:tree` @MaritvanDijk77
38. Maven • Check for updates: `mvn versions:display-dependency-updates` @MaritvanDijk77
39. Maven • Check for updates: `mvn versions:display-dependency-updates` @MaritvanDijk77
40. Maven • Analyze dependencies: `mvn dependency:analyze` @MaritvanDijk77
41. Gradle • Overview of dependencies: `./gradlew dependencies` @MaritvanDijk77
42. Gradle • Check for updates: • Add plugin, e.g. gradle-versions-plugin • Run `./gradlew dependencyUpdates` @MaritvanDijk77 https://github.com/ben-manes/gradle-versions-plugin
43. Gradle • Analyze dependencies • Add plugin (e.g. nebula) @MaritvanDijk77 https://github.com/nebula-plugins/gradle-lint-plugin/wiki/Unused-Dependency-Rule
44. Gradle • Analyze dependencies • Add plugin (e.g. nebula) • Run `./gradlew fixGradleLint` @MaritvanDijk77 https://github.com/nebula-plugins/gradle-lint-plugin/wiki/Unused-Dependency-Rule
45. IntelliJ IDEA: View Dependencies @MaritvanDijk77
46. IntelliJ IDEA: View Dependencies @MaritvanDijk77
47. IntelliJ IDEA: View Dependencies @MaritvanDijk77
48. IntelliJ IDEA: View Dependencies @MaritvanDijk77 https://www.jetbrains.com/help/idea/maven-projects-tool-window.html
49. IntelliJ IDEA: View Dependencies @MaritvanDijk77 https://www.jetbrains.com/help/idea/jetgradle-tool-window.html
50. IntelliJ IDEA: Dependency Analyzer @MaritvanDijk77 https://www.jetbrains.com/help/idea/work-with-maven-dependencies.html#dependency_analyzer
51. IntelliJ IDEA: Dependency Analyzer @MaritvanDijk77 https://www.jetbrains.com/help/idea/work-with-maven-dependencies.html#dependency_analyzer
52. IntelliJ IDEA: Dependency Analyzer @MaritvanDijk77 https://www.jetbrains.com/help/idea/work-with-gradle-dependency-diagram.html#dependency_analyzer
53. IntelliJ IDEA: Dependency Analyzer @MaritvanDijk77 https://www.jetbrains.com/help/idea/work-with-gradle-dependency-diagram.html#dependency_analyzer
54. IntelliJ IDEA: Dependency Analyzer @MaritvanDijk77 https://www.jetbrains.com/help/idea/work-with-gradle-dependency-diagram.html#dependency_analyzer
55. IntelliJ IDEA: Dependency Analyzer @MaritvanDijk77 https://www.jetbrains.com/help/idea/work-with-gradle-dependency-diagram.html#dependency_analyzer
56. IntelliJ IDEA • Package Search: Add dependency @MaritvanDijk77 https://www.jetbrains.com/help/idea/package-search.html
57. IntelliJ IDEA • Package Search: Add dependency @MaritvanDijk77 https://www.jetbrains.com/help/idea/package-search.html
58. IntelliJ IDEA @MaritvanDijk77 https://www.jetbrains.com/help/idea/package-search.html
59. IntelliJ IDEA: Update dependencies • Context Actions (⌥ ⏎ or Alt+Enter) @MaritvanDijk77
60. IntelliJ IDEA: Update dependencies • Hover @MaritvanDijk77 https://www.jetbrains.com/help/idea/package-analysis.html
61. IntelliJ IDEA: Update dependencies @MaritvanDijk77 https://www.jetbrains.com/help/idea/package-search.html
62. IntelliJ IDEA • Dependencies tool window @MaritvanDijk77 https://www.jetbrains.com/help/idea/package-search.html
63. IntelliJ IDEA: Dependency tool window @MaritvanDijk77 https://www.jetbrains.com/help/idea/package-search.html
64. IntelliJ IDEA • Dependencies tool window (search) @MaritvanDijk77 https://www.jetbrains.com/help/idea/package-search.html
65. IntelliJ IDEA • Dependencies tool window (search) @MaritvanDijk77 https://www.jetbrains.com/help/idea/package-search.html
66. IntelliJ IDEA https://www.jetbrains.com/help/idea/package-analysis.html @MaritvanDijk77
67. IntelliJ IDEA
68. IntelliJ IDEA @MaritvanDijk77 https://www.youtube.com/@intellijidea
69. Pros & Cons + Check dependencies while working on the project - Check out each individual project - Apply & verify updates @MaritvanDijk77
70. Software Composition Analysis (SCA) • Scan all repos (and containers) • Overview @MaritvanDijk77
71. SCA: Pros & Cons + No need to check out repos individually - I have to check the dashboard - Apply & verify updates @MaritvanDijk77
72. @MaritvanDijk77 Bots • Dependabot • Renovate • Snyk Open Source
73. Dependabot • GitHub native • Features: • Alerts • Security updates • Version updates @MaritvanDijk77
74. Dependabot enable @MaritvanDijk77
75. Dependabot alerts @MaritvanDijk77 https://docs.github.com/en/code-security/dependabot/dependabot-alerts/about-dependabot-alerts
76. Dependabot alerts @MaritvanDijk77
77. Dependabot security updates @MaritvanDijk77 https://docs.github.com/en/code-security/dependabot/dependabot-security-updates/about-dependabot-security-updates
78. Dependabot version updates • Add dependabot.yml • Specify: • Package manager & location of manifest file • Schedule interval (daily, weekly, or monthly) • Optional: • Max. number of PR's (default 5) • Rebase strategy • Etc @MaritvanDijk77 https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/about-dependabot-version-updates
79. Dependabot: Supported platforms • GitHub native • Can run on GitLab too @MaritvanDijk77
80. Renovate • Available via GitHub App • Features: • Security updates • Version updates • Project dashboard @MaritvanDijk77
81. Renovate enable @MaritvanDijk77 https://github.com/apps/renovate
82. Renovate enable - 3 @MaritvanDijk77
83. Renovate onboarding PR @MaritvanDijk77
84. Renovate configuration • All repos or selected repos • Config file is created for you • Scheduling • Max. number of PR's / concurrent branches • Rule based auto merge • More options & more fine-grained @MaritvanDijk77 https://docs.renovatebot.com/configuration-options/
85. Renovate PR @MaritvanDijk77 https://docs.renovatebot.com/merge-confidence/
86. Renovate Dashboard: Project @MaritvanDijk77
87. Renovate Dashboard: Jobs @MaritvanDijk77
88. Renovate: Supported platforms • GitHub (.com and Enterprise Server) • GitLab (.com and CE/EE) • Bitbucket Cloud • Bitbucket Server • Azure DevOps • AWS CodeCommit • Gitea @MaritvanDijk77 https://docs.renovatebot.com/#supported-platforms
89. Snyk Open Source • Available via Snyk • Features: • Security updates • Version updates • Test for new vulnerabilities (on PRs) • Test for vulnerabilities in source code • Dashboards @MaritvanDijk77 https://snyk.io/
90. Snyk enable @MaritvanDijk77 https://snyk.io/
91. Snyk enable - 2 @MaritvanDijk77
92. Snyk enable - 3 @MaritvanDijk77
93. Snyk enable - 4 @MaritvanDijk77
94. Snyk PR @MaritvanDijk77
95. Snyk PR @MaritvanDijk77
96. Snyk PR Check @MaritvanDijk77
97. Snyk dashboard @MaritvanDijk77
98. Snyk Open Source Configuration • Frequency (daily, weekly, never) • Enable/disable: New and/or known vulnerabilities • Enable/disable PR's for single project @MaritvanDijk77 https://docs.snyk.io/products/snyk-open-source/open-source-basics
99. Snyk Open Source: Supported Platforms • GitHub • GitHub Enterprise • GitHub Read-only projects • Bitbucket Cloud Personal Access Token (Legacy) • Bitbucket Cloud App • Bitbucket Data Center/Server • GitLab • Azure Repos @MaritvanDijk77 https://docs.snyk.io/integrations/git-repository-scm-integrations
100. @MaritvanDijk77 Bots • Dependabot • Renovate • Snyk Open Source
101. Bots: Pros & Cons + Relatively easy to install + Automatic PR's - Can create "noise" - Manage PRs (merge & deploy) - No code changes (if needed) @MaritvanDijk77
102. Migration tools @MaritvanDijk77
103. IntelliJ IDEA • Refactor > Migrate Packages and Classes @MaritvanDijk77 https://www.jetbrains.com/help/idea/migrate.html
104. IntelliJ IDEA • Refactor > Migrate Packages and Classes @MaritvanDijk77 https://www.jetbrains.com/help/idea/migrate.html
105. IntelliJ IDEA • Create New Migration @MaritvanDijk77
106. IntelliJ IDEA • Create New Migration @MaritvanDijk77
107. IntelliJ IDEA @MaritvanDijk77 https://www.youtube.com/@intellijidea
108. Error Prone • Static analysis tool for Java to catch common programming mistakes at compile-time. • Maven, Gradle, etc. • IntelliJ IDEA / Eclipse plugin, Command line • Bug patterns • Report or fix • Custom checks • Includes Refaster: refactor code using before-and-after templates @MaritvanDijk77 https://errorprone.info/
109. Error Prone @MaritvanDijk77 https://www.youtube.com/watch?v=NPuLeoIzIR0
110. Error Prone Support @MaritvanDijk77 https://error-prone.picnic.tech/
111. OpenRewrite • Source code refactoring for framework/API migrations, vulnerability patches, and static code analysis fixes • Early focus on Java • Kotlin - early support, actively developed • Groovy - focus on Gradle dependency manipulation, works on most Groovy source code too • Python • JavaScript - in development, not released yet @MaritvanDijk77 https://docs.openrewrite.org/
112. OpenRewrite • Existing recipes @MaritvanDijk77 https://docs.openrewrite.org/running-recipes/popular-recipe-guides
113. OpenRewrite • Existing recipes @MaritvanDijk77 https://docs.openrewrite.org/reference/recipes
114. OpenRewrite • Existing recipes • Can author recipes @MaritvanDijk77 https://docs.openrewrite.org/
115. OpenRewrite @MaritvanDijk77 https://sched.co/1K3zc
116. Conclusion •(Re)evaluate dependencies carefully •Automate checks & updates •Stay safe! @MaritvanDijk77
117. Slides & More https://maritvandijk.com/presentations/keep-your-dependencies-in-check/ @MaritvanDijk77