Keep your dependencies in check (Devoxx PL)

If Log4Shell, Spring4Shell, etc. have taught us anything, it’s that we need to keep our dependencies up to date. But updating our applications can take a lot of time. How do we stay on top of that, while also continuing to deliver business value?

Luckily, there are plenty of tools that can help us with this, from package managers to bots that can automatically create changes on our repositories. Let’s go over some of the different options, so we can make informed choices about what’s best for us in a particular situation.

Transcript

1. @MaritvanDijk77 #DevoxxPL Keep your dependencies in check Marit van Dijk JetBrains Platinum Sponsors
6. Dec. 2021
10. March 2022
15. Do we need this dependency? https://maritvandijk.com/selecting-dependencies/
16. Selecting dependencies
17. https://www.sonatype.com/resources/log4j-vulnerability-resource-center
18. No dependencies Maintain dependencies
19. Maven • Overview of dependencies: `mvn dependency:tree`
20. Maven • Check for updates: `mvn versions:display-dependency-updates`
21. Maven • Check for updates: `mvn versions:display-dependency-updates`
22. Maven • Analyze dependencies: `mvn dependency:analyze`
23. Gradle • Overview of dependencies: `./gradlew dependencies`
24. Gradle • Check for updates: • Add plugin, e.g. gradle-versions-plugin • Run `./gradlew dependencyUpdates` https://github.com/ben-manes/gradle-versions-plugin
25. Gradle • Analyze dependencies • Add plugin (e.g. nebula) https://github.com/nebula-plugins/gradle-lint-plugin/wiki/Unused-Dependency-Rule
26. Gradle • Analyze dependencies • Add plugin (e.g. nebula) • Run `./gradlew fixGradleLint` https://github.com/nebula-plugins/gradle-lint-plugin/wiki/Unused-Dependency-Rule
27. IntelliJ IDEA: View Dependencies
28. IntelliJ IDEA: View Dependencies
29. IntelliJ IDEA: View Dependencies
30. IntelliJ IDEA: View Dependencies https://www.jetbrains.com/help/idea/maven-projects-tool-window.html
31. IntelliJ IDEA: View Dependencies https://www.jetbrains.com/help/idea/jetgradle-tool-window.html
32. IntelliJ IDEA: Dependency Analyzer https://www.jetbrains.com/help/idea/work-with-maven-dependencies.html#dependency_analyzer
33. IntelliJ IDEA: Dependency Analyzer https://www.jetbrains.com/help/idea/work-with-maven-dependencies.html#dependency_analyzer
34. IntelliJ IDEA: Dependency Analyzer https://www.jetbrains.com/help/idea/work-with-gradle-dependency-diagram.html#dependency_analyzer
35. IntelliJ IDEA: Dependency Analyzer https://www.jetbrains.com/help/idea/work-with-gradle-dependency-diagram.html#dependency_analyzer
36. IntelliJ IDEA: Dependency Analyzer https://www.jetbrains.com/help/idea/work-with-gradle-dependency-diagram.html#dependency_analyzer
37. IntelliJ IDEA: Dependency Analyzer https://www.jetbrains.com/help/idea/work-with-gradle-dependency-diagram.html#dependency_analyzer
38. IntelliJ IDEA • Add dependency
39. IntelliJ IDEA • Add dependency
40. IntelliJ IDEA • Add dependency
41. IntelliJ IDEA: Package Search https://www.jetbrains.com/help/idea/package-search.html
42. IntelliJ IDEA • Package Search tool window https://www.jetbrains.com/help/idea/package-search.html
43. IntelliJ IDEA: Update dependencies • Hover https://www.jetbrains.com/help/idea/package-analysis.html
44. IntelliJ IDEA: Update dependencies • Context Actions (⌥ ⏎ or Alt+Enter)
45. IntelliJ IDEA https://www.jetbrains.com/help/idea/package-analysis.html • Vulnerable Dependencies tab in Problems window
46. IntelliJ IDEA • Vulnerable API Usage https://www.jetbrains.com/help/idea/package-analysis.html#find-vulnerable-api
47. IntelliJ IDEA • Vulnerable API Usage https://www.jetbrains.com/help/idea/package-analysis.html#find-vulnerable-api
48. IntelliJ IDEA • Vulnerable API Usage https://www.jetbrains.com/help/idea/package-analysis.html#find-vulnerable-api
49. IntelliJ IDEA • Vulnerable API Usage https://www.jetbrains.com/help/idea/package-analysis.html#find-vulnerable-api
50. IntelliJ IDEA • Vulnerable API Usage • Context Actions (⌥ ⏎ or Alt+Enter) https://www.jetbrains.com/help/idea/package-analysis.html#find-vulnerable-api
51. Pros & Cons + Check dependencies while working on the project - Check out each individual project - Apply & verify updates
52. Software Composition Analysis (SCA) • Scan all repos (and containers) • Overview
53. JetBrains Qodana https://www.jetbrains.com/qodana/
54. SCA: Pros & Cons + No need to check out repos individually - I have to check the dashboard - Apply & verify updates
55. Bots • Dependabot • Renovate • Snyk Open Source
56. Dependabot • GitHub native • Features: • Alerts • Auto-triage rules (preset & custom) • Security updates • Version updates https://docs.github.com/en/code-security/dependabot
57. Dependabot version updates • Add dependabot.yml • Specify: • Package manager & location of manifest file • Schedule interval (daily, weekly, or monthly) • Optional: • Max. number of PR's (default 5) • Rebase strategy • Etc https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/about-dependabot-version-updates
58. Renovate • Available via GitHub App • Features: • Security updates • Version updates • Replace deprecated dependencies with community suggested dependencies • Project dashboard https://docs.renovatebot.com/
59. Renovate configuration • All repos or selected repos • Config file is created for you • Scheduling • Max. number of PR's / concurrent branches • Rule based auto merge • More options & more fine-grained https://docs.renovatebot.com/configuration-options/
60. Renovate: Supported platforms • GitHub (.com and Enterprise Server) • GitLab (.com and CE/EE) • Bitbucket Cloud • Bitbucket Server • Azure DevOps • AWS CodeCommit • Gitea and Forgejo • Gerrit (experimental) https://docs.renovatebot.com/#supported-platforms
61. Snyk Open Source • Available via Snyk • Features: • Security updates • Version updates • Dashboards • Test for new vulnerabilities (on PRs) • Test for vulnerabilities in source code https://snyk.io/
62. Snyk Open Source Configuration • Frequency (daily, weekly, never) • Enable/disable: New and/or known vulnerabilities • Enable/disable PR's for single project https://docs.snyk.io/products/snyk-open-source/open-source-basics
63. Snyk Open Source: Supported Platforms • GitHub Cloud App • GitHub Enterprise • GitHub • GitHub Read-only projects • GitLab • Bitbucket Cloud • Bitbucket Cloud (Legacy) • Bitbucket Cloud App • Bitbucket Data Center/Server • Azure Repositories (TFS) https://docs.snyk.io/integrations/git-repository-scm-integrations
64. Bots • Dependabot • Renovate • Snyk Open Source
65. Bots: Pros & Cons + Relatively easy to install + Automatic PR's - Can create "noise" - Manage PRs (merge & deploy) - Do NOT update your code (if needed)
66. Migration tools
67. IntelliJ IDEA • Refactor > Migrate Packages and Classes https://www.jetbrains.com/help/idea/migrate.html
68. IntelliJ IDEA • Refactor > Migrate Packages and Classes > • Java EE to Jakarta EE • JUnit (4.x -> 5.0) • JavaFX (8 -> 9) https://www.jetbrains.com/help/idea/migrate.html
69. IntelliJ IDEA • Create New Migration
70. IntelliJ IDEA • Create New Migration
71. Error Prone • Static analysis tool for Java to catch common programming mistakes at compile-time. • Maven, Gradle, Bazel, Ant • IntelliJ IDEA / Eclipse plugin, Command line • Bug patterns • Report or fix • Custom checks • Includes Refaster: refactor code using before-and-after templates https://errorprone.info/
72. Error Prone https://errorprone.info/bugpatterns
73. OpenRewrite • Source code refactoring for framework/API migrations, vulnerability patches, and static code analysis fixes • Java, Kotlin & Groovy support • Run using Maven/Gradle plugin • or from a yaml file https://docs.openrewrite.org/
74. OpenRewrite • Existing recipes • Upgrade versions • Migrate libraries • Fix static analysis issues https://docs.openrewrite.org/running-recipes/popular-recipe-guides
75. OpenRewrite • Existing recipes • Find by topic https://docs.openrewrite.org/reference/recipes
76. OpenRewrite • Existing recipes • Can author your own recipes https://docs.openrewrite.org/
77. OpenRewrite support in IntelliJ IDEA https://www.jetbrains.com/help/idea/openrewrite.html
78. OpenRewrite support in IntelliJ IDEA • From Project tool window • New (⌘N or Alt+Insert) https://www.jetbrains.com/help/idea/openrewrite.html
79. OpenRewrite support in IntelliJ IDEA • For example: https://www.jetbrains.com/help/idea/openrewrite.html
80. OpenRewrite support in IntelliJ IDEA https://www.jetbrains.com/help/idea/openrewrite.html
81. OpenRewrite support in IntelliJ IDEA
82. OpenRewrite support in IntelliJ IDEA
83. OpenRewrite support in IntelliJ IDEA
84. Conclusion •(Re)evaluate dependencies carefully •Use the tools you have! •Automate checks & updates as much as possible •Stay safe!
85. Slides & More https://maritvandijk.com/presentations/keep-your-dependencies-in-check/