Keep your dependencies in check (FOSDEM)

If Log4Shell, Spring4Shell, etc. have taught us anything, it’s that we need to keep our dependencies up to date. But updating our applications can take a lot of time. How do we stay on top of that, while also continuing to deliver business value?

Luckily, there are plenty of tools that can help us with this, from package managers to bots that can automatically create changes on our repositories. Let’s go over some of the different options, so we can make informed choices about what’s best for us in a particular situation.

Transcript

1. Keep your dependencies in check
   FOSDEM - February 5th, 2023
   https://maritvandijk.com/ @MaritvanDijk77
   

   View Slide

2. @MaritvanDijk77
   

   View Slide

3. @MaritvanDijk77
   

   View Slide

4. @MaritvanDijk77
   

   View Slide

5. @MaritvanDijk77
   

   View Slide

6. Dec. 2021
   @MaritvanDijk77
   

   View Slide

7. @MaritvanDijk77
   

   View Slide

8. @MaritvanDijk77
   

   View Slide

9. @MaritvanDijk77
   

   View Slide

10. March 2022
    @MaritvanDijk77
    

    View Slide

11. @MaritvanDijk77
    

    View Slide

12. @MaritvanDijk77
    

    View Slide

13. No dependencies
    @MaritvanDijk77
    Maintain dependencies
    

    View Slide

14. Maven
    • Overview of dependencies: `mvn dependency:tree`
    @MaritvanDijk77
    

    View Slide

15. Maven
    • Check for updates: `mvn versions:display-dependency-updates`
    @MaritvanDijk77
    

    View Slide

16. Maven
    • Analyze dependencies: `mvn dependency:analyze`
    @MaritvanDijk77
    

    View Slide

17. Gradle
    • Overview of dependencies: `./gradlew dependencies`
    @MaritvanDijk77
    

    View Slide

18. Gradle
    • Add plugin, e.g. gradle-versions-plugin
    
    
    • Run `./gradlew dependencyUpdates`
    @MaritvanDijk77
    https://github.com/ben-manes/gradle-versions-plugin
    

    View Slide

19. IntelliJ IDEA: View Dependencies
    @MaritvanDijk77
    

    View Slide

20. IntelliJ IDEA: View Dependencies
    @MaritvanDijk77
    

    View Slide

21. IntelliJ IDEA
    • Package Search: Add dependency
    @MaritvanDijk77
    https://www.jetbrains.com/help/idea/package-search.html
    

    View Slide

22. IntelliJ IDEA
    • Package Search: Add dependency
    @MaritvanDijk77
    https://www.jetbrains.com/help/idea/package-search.html
    

    View Slide

23. IntelliJ IDEA
    • Intention actions (⌥ ⏎ or Alt+Enter)
    @MaritvanDijk77
    https://www.jetbrains.com/help/idea/package-search.html
    

    View Slide

24. IntelliJ IDEA
    • Intention actions (⌥ ⏎ or Alt+Enter)
    @MaritvanDijk77
    https://www.jetbrains.com/help/idea/package-search.html
    

    View Slide

25. IntelliJ IDEA
    • Package search: Dependencies tool window
    @MaritvanDijk77
    https://www.jetbrains.com/help/idea/package-search.html
    

    View Slide

26. IntelliJ IDEA
    • Package search: Dependencies tool window
    @MaritvanDijk77
    https://www.jetbrains.com/help/idea/package-search.html
    

    View Slide

27. IntelliJ IDEA Ultimate
    @MaritvanDijk77
    • Package Checker
    

    View Slide

28. IntelliJ IDEA Ultimate
    @MaritvanDijk77
    • Package Checker
    

    View Slide

29. Downsides
    - Check out each individual project
    
    
    - Apply & verify updates
    @MaritvanDijk77
    

    View Slide

30. Software Composition Analysis (SCA)
    • Scan all repos (and containers)
    
    
    • Overview
    @MaritvanDijk77
    

    View Slide

31. SCA: Pros & Cons
    + No need to check out repos individually
    
    
    - I have to check the dashboard
    
    
    - Apply & verify updates
    @MaritvanDijk77
    

    View Slide

32. @MaritvanDijk77
    Bots
    • Dependabot
    
    
    • Renovate
    
    
    • Snyk Open Source
    

    View Slide

33. Dependabot
    • GitHub native
    
    
    • Features:
    
    
    • Alerts
    
    
    • Security updates
    
    
    • Version updates
    @MaritvanDijk77
    

    View Slide

34. Dependabot enable
    @MaritvanDijk77
    

    View Slide

35. Dependabot alerts
    @MaritvanDijk77
    

    View Slide

36. Dependabot security updates
    @MaritvanDijk77
    

    View Slide

37. Dependabot version updates
    • Add dependabot.yml (impacts security updates)
    
    
    • Package manager & directory manifest file
    
    
    • Frequency (daily, weekly, or monthly)
    
    
    • Schedule (date, time, timezone)
    
    
    • Max. number of PR's (default 5)
    
    
    • Some details to manage PR's
    @MaritvanDijk77
    https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
    

    View Slide

38. Renovate
    • Available via GitHub App
    
    
    • Features:
    
    
    • Security updates
    
    
    • Version updates
    
    
    • Project dashboard
    
    
    • Job dashboard
    @MaritvanDijk77
    

    View Slide

39. Renovate enable
    @MaritvanDijk77
    https://github.com/apps/renovate
    

    View Slide

40. Renovate enable - 2
    @MaritvanDijk77
    

    View Slide

41. Renovate enable - 3
    @MaritvanDijk77
    

    View Slide

42. Renovate configuration
    • All repos or selected repos
    
    
    • Config file is created for you
    
    
    • Max. number of PR's / concurrent branches
    
    
    • More options
    
    
    • More fine-grained
    @MaritvanDijk77
    https://docs.renovatebot.com/configuration-options/
    

    View Slide

43. Renovate PR
    @MaritvanDijk77
    https://docs.renovatebot.com/merge-confidence/
    

    View Slide

44. Renovate Dashboard: Project
    @MaritvanDijk77
    

    View Slide

45. Renovate Dashboard: Jobs
    @MaritvanDijk77
    

    View Slide

46. Snyk Open Source
    • Available via Snyk
    
    
    • Features:
    
    
    • Security updates
    
    
    • Version updates
    
    
    • Test for new vulnerabilities (on PRs)
    
    
    • Test for vulnerabilities in source code
    
    
    • Dashboards
    @MaritvanDijk77
    https://snyk.io/
    

    View Slide

47. Snyk enable
    @MaritvanDijk77
    https://snyk.io/
    

    View Slide

48. Snyk enable - 2
    @MaritvanDijk77
    

    View Slide

49. Snyk enable - 3
    @MaritvanDijk77
    

    View Slide

50. Snyk enable - 4
    @MaritvanDijk77
    

    View Slide

51. Snyk PR
    @MaritvanDijk77
    

    View Slide

52. Snyk PR
    @MaritvanDijk77
    

    View Slide

53. Snyk PR Check
    @MaritvanDijk77
    

    View Slide

54. Snyk dashboard
    @MaritvanDijk77
    

    View Slide

55. Snyk Open Source Configuration
    • Frequency (daily, weekly, never)
    
    
    • Enable/disable: New and/or known vulnerabilities
    
    
    • Enable/disable PR's for single project
    @MaritvanDijk77
    https://docs.snyk.io/products/snyk-open-source/open-source-basics
    

    View Slide

56. Bots: Pros & Cons
    + Relatively easy to install
    
    
    + Automatic PR's
    
    
    - Can create "noise"
    
    
    - Manage PRs (merge & deploy)
    
    
    - No code changes (if needed)
    @MaritvanDijk77
    

    View Slide

57. Migration tools
    @MaritvanDijk77
    

    View Slide

58. IntelliJ IDEA
    • Migrate Packages and Classes
    @MaritvanDijk77
    https://www.jetbrains.com/help/idea/migrate.html
    

    View Slide

59. IntelliJ IDEA
    • Create New Migration
    @MaritvanDijk77
    

    View Slide

60. IntelliJ IDEA
    • Create New Migration
    @MaritvanDijk77
    

    View Slide

61. Error Prone
    • Static analysis tool for Java that catches common programming
    mistakes at compile-time.
    
    
    • Maven, Gradle, etc.
    
    
    • IntelliJ IDEA / Eclipse plugin, Command line
    
    
    • Bug patterns
    
    
    • Report or fix
    
    
    • Custom checks
    
    
    • Includes Refaster: refactor code using before-and-after templates
    @MaritvanDijk77
    https://errorprone.info/
    

    View Slide

62. OpenRewrite
    • Source code refactoring for framework migrations, vulnerability
    patches, and API migrations
    
    
    • Early focus on Java
    
    
    • Maven & Gradle
    
    
    • Existing recipes
    
    
    • Can author recipes
    @MaritvanDijk77
    https://docs.openrewrite.org/
    

    View Slide

63. Conclusion
    •(Re)evaluate dependencies carefully
    
    
    •Automate checks & updates
    
    
    •Stay safe!
    @MaritvanDijk77
    

    View Slide

64. Slides
    https://maritvandijk.com/presentations/keep-your-dependencies-in-check/
    
    
    @MaritvanDijk77
    

    View Slide