Keep_your_dependencies_in_check_BrabantJUG.pdf

Transcript

1. Keep your dependencies in check
   BrabantJUG - March 7th, 2023
   https://maritvandijk.com/ @MaritvanDijk77
   

   View Slide

2. @MaritvanDijk77
   

   View Slide

3. @MaritvanDijk77
   

   View Slide

4. @MaritvanDijk77
   

   View Slide

5. @MaritvanDijk77
   

   View Slide

6. Dec. 2021
   @MaritvanDijk77
   

   View Slide

7. @MaritvanDijk77
   

   View Slide

8. @MaritvanDijk77
   

   View Slide

9. @MaritvanDijk77
   

   View Slide

10. March 2022
    @MaritvanDijk77
    

    View Slide

11. @MaritvanDijk77
    

    View Slide

12. @MaritvanDijk77
    

    View Slide

13. @MaritvanDijk77
    

    View Slide

14. @MaritvanDijk77
    

    View Slide

15. @MaritvanDijk77
    Do we
    
    
    need
    
    
    this
    dependency?
    

    View Slide

16. Selecting dependencies
    @MaritvanDijk77
    

    View Slide

17. Selecting dependencies
    @MaritvanDijk77
    

    View Slide

18. @MaritvanDijk77
    https://xkcd.com/2347/
    

    View Slide

19. Selecting dependencies
    @MaritvanDijk77
    

    View Slide

20. Selecting dependencies
    @MaritvanDijk77
    

    View Slide

21. Selecting dependencies @MaritvanDijk77
    

    View Slide

22. Selecting dependencies
    @MaritvanDijk77
    

    View Slide

23. @MaritvanDijk77
    Find information
    

    View Slide

24. Dependency information
    @MaritvanDijk77
    https://search.maven.org/
    

    View Slide

25. Dependency information
    @MaritvanDijk77
    https://search.maven.org/
    

    View Slide

26. Dependency information
    @MaritvanDijk77
    

    View Slide

27. Dependency information
    @MaritvanDijk77
    

    View Slide

28. Dependency information
    @MaritvanDijk77
    https://package-search.jetbrains.com/
    

    View Slide

29. Dependency information
    @MaritvanDijk77
    https://package-search.jetbrains.com/
    

    View Slide

30. Dependency information
    @MaritvanDijk77
    https://package-search.jetbrains.com/
    

    View Slide

31. Dependency information
    @MaritvanDijk77
    https://github.com/
    

    View Slide

32. Dependency information
    @MaritvanDijk77
    https://github.com/
    

    View Slide

33. No dependencies
    @MaritvanDijk77
    Maintain dependencies
    

    View Slide

34. Maven
    • Overview of dependencies: `mvn dependency:tree`
    @MaritvanDijk77
    

    View Slide

35. Maven
    • Check for updates: `mvn versions:display-dependency-updates`
    @MaritvanDijk77
    

    View Slide

36. Maven
    • Analyze dependencies: `mvn dependency:analyze`
    @MaritvanDijk77
    

    View Slide

37. Gradle
    • Overview of dependencies: `./gradlew dependencies`
    @MaritvanDijk77
    

    View Slide

38. Gradle
    • Add plugin, e.g. gradle-versions-plugin
    
    
    • Run `./gradlew dependencyUpdates`
    @MaritvanDijk77
    https://github.com/ben-manes/gradle-versions-plugin
    

    View Slide

39. IntelliJ IDEA: View Dependencies
    @MaritvanDijk77
    https://www.jetbrains.com/help/idea/maven-projects-tool-window.html
    

    View Slide

40. IntelliJ IDEA: View Dependencies
    @MaritvanDijk77
    https://www.jetbrains.com/help/idea/jetgradle-tool-window.html
    

    View Slide

41. IntelliJ IDEA: Dependency Analyzer
    @MaritvanDijk77
    https://www.jetbrains.com/help/idea/work-with-maven-dependencies.html#dependency_analyzer
    

    View Slide

42. IntelliJ IDEA: Dependency Analyzer
    @MaritvanDijk77
    https://www.jetbrains.com/help/idea/work-with-maven-dependencies.html#dependency_analyzer
    

    View Slide

43. IntelliJ IDEA: Dependency Analyzer
    @MaritvanDijk77
    https://www.jetbrains.com/help/idea/work-with-gradle-dependency-diagram.html#dependency_analyzer
    

    View Slide

44. IntelliJ IDEA: Dependency Analyzer
    @MaritvanDijk77
    https://www.jetbrains.com/help/idea/work-with-gradle-dependency-diagram.html#dependency_analyzer
    

    View Slide

45. IntelliJ IDEA
    • Package Search: Add dependency
    @MaritvanDijk77
    https://www.jetbrains.com/help/idea/package-search.html
    

    View Slide

46. IntelliJ IDEA
    • Package Search: Add dependency
    @MaritvanDijk77
    https://www.jetbrains.com/help/idea/package-search.html
    

    View Slide

47. IntelliJ IDEA: Update dependencies
    • Intention actions (⌥ ⏎ or Alt+Enter) or hover
    @MaritvanDijk77
    https://www.jetbrains.com/help/idea/package-search.html
    

    View Slide

48. IntelliJ IDEA: Update dependencies
    @MaritvanDijk77
    https://www.jetbrains.com/help/idea/package-search.html
    

    View Slide

49. IntelliJ IDEA
    • Intention actions (⌥ ⏎ or Alt+Enter) or hover
    @MaritvanDijk77
    https://www.jetbrains.com/help/idea/package-search.html
    

    View Slide

50. IntelliJ IDEA
    • Package search: Dependencies tool window
    @MaritvanDijk77
    https://www.jetbrains.com/help/idea/package-search.html
    

    View Slide

51. IntelliJ IDEA
    • Package search: Dependencies tool window
    @MaritvanDijk77
    https://www.jetbrains.com/help/idea/package-search.html
    

    View Slide

52. IntelliJ IDEA: Dependency tool window
    @MaritvanDijk77
    https://www.jetbrains.com/help/idea/package-search.html
    

    View Slide

53. IntelliJ IDEA Ultimate
    @MaritvanDijk77
    • Package Checker
    

    View Slide

54. IntelliJ IDEA Ultimate: Package checker
    

    View Slide

55. IntelliJ IDEA Ultimate: Package checker
    

    View Slide

56. Downsides
    - Check out each individual project
    
    
    - Apply & verify updates
    @MaritvanDijk77
    

    View Slide

57. Software Composition Analysis (SCA)
    • Scan all repos (and containers)
    
    
    • Overview
    @MaritvanDijk77
    

    View Slide

58. SCA: Pros & Cons
    + No need to check out repos individually
    
    
    - I have to check the dashboard
    
    
    - Apply & verify updates
    
    
    @MaritvanDijk77
    

    View Slide

59. @MaritvanDijk77
    Bots
    • Dependabot
    
    
    • Renovate
    
    
    • Snyk Open Source
    

    View Slide

60. Dependabot
    • GitHub native
    
    
    • Features:
    
    
    • Alerts
    
    
    • Security updates
    
    
    • Version updates
    @MaritvanDijk77
    

    View Slide

61. Dependabot enable
    @MaritvanDijk77
    

    View Slide

62. Dependabot alerts
    @MaritvanDijk77
    

    View Slide

63. Dependabot security updates
    @MaritvanDijk77
    

    View Slide

64. Dependabot version updates
    • Add dependabot.yml (impacts security updates)
    
    
    • Package manager & directory manifest file
    
    
    • Frequency (daily, weekly, or monthly)
    
    
    • Schedule (date, time, timezone)
    
    
    • Max. number of PR's (default 5)
    
    
    • Some details to manage PR's
    @MaritvanDijk77
    https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
    

    View Slide

65. Renovate
    • Available via GitHub App
    
    
    • Features:
    
    
    • Security updates
    
    
    • Version updates
    
    
    • Project dashboard
    @MaritvanDijk77
    

    View Slide

66. Renovate enable
    @MaritvanDijk77
    https://github.com/apps/renovate
    

    View Slide

67. Renovate enable - 2
    @MaritvanDijk77
    

    View Slide

68. Renovate configuration
    • All repos or selected repos
    
    
    • Config file is created for you
    
    
    • Max. number of PR's / concurrent branches
    
    
    • More options
    
    
    • More fine-grained
    @MaritvanDijk77
    https://docs.renovatebot.com/configuration-options/
    

    View Slide

69. Renovate PR
    @MaritvanDijk77
    https://docs.renovatebot.com/merge-confidence/
    

    View Slide

70. Renovate Dashboard: Project
    @MaritvanDijk77
    

    View Slide

71. Renovate Dashboard: Jobs
    @MaritvanDijk77
    

    View Slide

72. Snyk Open Source
    • Available via Snyk
    
    
    • Features:
    
    
    • Security updates
    
    
    • Version updates
    
    
    • Test for new vulnerabilities (on PRs)
    
    
    • Test for vulnerabilities in source code
    
    
    • Dashboards
    @MaritvanDijk77
    https://snyk.io/
    

    View Slide

73. Snyk enable
    @MaritvanDijk77
    https://snyk.io/
    

    View Slide

74. Snyk enable - 2
    @MaritvanDijk77
    

    View Slide

75. Snyk enable - 3
    @MaritvanDijk77
    

    View Slide

76. Snyk enable - 4
    @MaritvanDijk77
    

    View Slide

77. Snyk PR
    @MaritvanDijk77
    

    View Slide

78. Snyk PR
    @MaritvanDijk77
    

    View Slide

79. Snyk PR Check
    @MaritvanDijk77
    

    View Slide

80. Snyk dashboard
    @MaritvanDijk77
    

    View Slide

81. Snyk Open Source Configuration
    • Frequency (daily, weekly, never)
    
    
    • Enable/disable: New and/or known vulnerabilities
    
    
    • Enable/disable PR's for single project
    @MaritvanDijk77
    https://docs.snyk.io/products/snyk-open-source/open-source-basics
    

    View Slide

82. Bots: Pros & Cons
    + Relatively easy to install
    
    
    + Automatic PR's
    
    
    - Can create "noise"
    
    
    - Manage PRs (merge & deploy)
    
    
    - No code changes (if needed)
    @MaritvanDijk77
    

    View Slide

83. Migration tools
    @MaritvanDijk77
    

    View Slide

84. IntelliJ IDEA
    • Migrate Packages and Classes
    @MaritvanDijk77
    https://www.jetbrains.com/help/idea/migrate.html
    

    View Slide

85. IntelliJ IDEA
    • Create New Migration
    @MaritvanDijk77
    

    View Slide

86. IntelliJ IDEA
    • Create New Migration
    @MaritvanDijk77
    

    View Slide

87. IntelliJ IDEA
    @MaritvanDijk77
    https://www.youtube.com/@intellijidea
    

    View Slide

88. Error Prone
    • Static analysis tool for Java that catches common programming
    mistakes at compile-time.
    
    
    • Maven, Gradle, etc.
    
    
    • IntelliJ IDEA / Eclipse plugin, Command line
    
    
    • Bug patterns
    
    
    • Report or fix
    
    
    • Custom checks
    
    
    • Includes Refaster: refactor code using before-and-after templates
    @MaritvanDijk77
    https://errorprone.info/
    

    View Slide

89. OpenRewrite
    • Source code refactoring for framework migrations, vulnerability
    patches, and API migrations
    
    
    • Early focus on Java
    
    
    • Maven & Gradle
    
    
    • Existing recipes
    
    
    • Can author recipes
    @MaritvanDijk77
    https://docs.openrewrite.org/
    

    View Slide

90. Quickstart: Maven and Gradle
    • Add plugin:
    @MaritvanDijk77
    https://docs.openrewrite.org/getting-started/getting-started
    

    View Slide

91. @MaritvanDijk77
    https://docs.openrewrite.org/getting-started/getting-started
    • Discover: `./mvnw rewrite:discover`
    

    View Slide

92. Quickstart: Maven and Gradle
    • Configure plugin:
    @MaritvanDijk77
    https://docs.openrewrite.org/getting-started/getting-started
    

    View Slide

93. @MaritvanDijk77
    https://docs.openrewrite.org/getting-started/getting-started
    • Run: `./mvnw rewrite:run`
    

    View Slide

94. Quickstart: Maven and Gradle
    @MaritvanDijk77
    https://docs.openrewrite.org/getting-started/getting-started
    

    View Slide

95. Quickstart: Maven and Gradle
    @MaritvanDijk77
    https://docs.openrewrite.org/getting-started/getting-started
    

    View Slide

96. Conclusion
    •(Re)evaluate dependencies carefully
    
    
    •Automate checks & updates
    
    
    •Stay safe!
    @MaritvanDijk77
    

    View Slide

97. Slides & More
    https://maritvandijk.com/presentations/keep-your-dependencies-in-check/
    
    
    @MaritvanDijk77
    

    View Slide