Keep_your_dependencies_in_check_Volksbank.pdf

If Log4Shell, Spring4Shell, etc. have taught us anything, it’s that we need to keep our dependencies up to date. But updating our applications can take a lot of time. How do we stay on top of that, while also continuing to deliver business value?

Luckily, there are plenty of tools that can help us with this, from package managers to bots that can automatically create changes on our repositories. Let’s go over some of the different options, so we can make informed choices about what’s best for us in a particular situation.

Transcript

1. Keep your dependencies in check Volksbank - April 16, 2024 https://maritvandijk.com/
6. Dec. 2021
10. March 2022
15. Do we need this dependency? https://maritvandijk.com/selecting-dependencies/
16. Selecting dependencies
17. Selecting dependencies
18. https://xkcd.com/2347/
19. Selecting dependencies
20. Selecting dependencies
21. Selecting dependencies
22. Selecting dependencies
23. https://www.sonatype.com/resources/log4j-vulnerability-resource-center
24. Find information
25. Dependency information https://search.maven.org/
26. Dependency information https://search.maven.org/artifact/com.fasterxml.jackson.core/jackson-databind/2.17.0/jar
27. Dependency information
28. Dependency information
29. Dependency information https://package-search.jetbrains.com/
30. Dependency information https://package-search.jetbrains.com/
31. Dependency information https://package-search.jetbrains.com/
32. Dependency information https://github.com/
33. Dependency information https://github.com/
34. Dependency information https://github.com/
35. https://maritvandijk.com/presentations/collaborating-on-open-source-software/
36. No dependencies Maintain dependencies
37. Maven • Overview of dependencies: `mvn dependency:tree`
38. Maven • Check for updates: `mvn versions:display-dependency-updates`
39. Maven • Check for updates: `mvn versions:display-dependency-updates`
40. Maven • Analyze dependencies: `mvn dependency:analyze`
41. Gradle • Overview of dependencies: `./gradlew dependencies`
42. Gradle • Check for updates: • Add plugin, e.g. gradle-versions-plugin • Run `./gradlew dependencyUpdates` https://github.com/ben-manes/gradle-versions-plugin
43. Gradle • Analyze dependencies • Add plugin (e.g. nebula) https://github.com/nebula-plugins/gradle-lint-plugin/wiki/Unused-Dependency-Rule
44. Gradle • Analyze dependencies • Add plugin (e.g. nebula) • Run `./gradlew fixGradleLint` https://github.com/nebula-plugins/gradle-lint-plugin/wiki/Unused-Dependency-Rule
45. IntelliJ IDEA: View Dependencies
46. IntelliJ IDEA: View Dependencies
47. IntelliJ IDEA: View Dependencies
48. IntelliJ IDEA: View Dependencies https://www.jetbrains.com/help/idea/maven-projects-tool-window.html
49. IntelliJ IDEA: View Dependencies https://www.jetbrains.com/help/idea/jetgradle-tool-window.html
50. IntelliJ IDEA: Dependency Analyzer https://www.jetbrains.com/help/idea/work-with-maven-dependencies.html#dependency_analyzer
51. IntelliJ IDEA: Dependency Analyzer https://www.jetbrains.com/help/idea/work-with-maven-dependencies.html#dependency_analyzer
52. IntelliJ IDEA: Dependency Analyzer https://www.jetbrains.com/help/idea/work-with-gradle-dependency-diagram.html#dependency_analyzer
53. IntelliJ IDEA: Dependency Analyzer https://www.jetbrains.com/help/idea/work-with-gradle-dependency-diagram.html#dependency_analyzer
54. IntelliJ IDEA: Dependency Analyzer https://www.jetbrains.com/help/idea/work-with-gradle-dependency-diagram.html#dependency_analyzer
55. IntelliJ IDEA: Dependency Analyzer https://www.jetbrains.com/help/idea/work-with-gradle-dependency-diagram.html#dependency_analyzer
56. IntelliJ IDEA • Add dependency
57. IntelliJ IDEA • Add dependency
58. IntelliJ IDEA • Add dependency
59. IntelliJ IDEA: Package Search https://www.jetbrains.com/help/idea/package-search.html
60. IntelliJ IDEA • Package Search tool window https://www.jetbrains.com/help/idea/package-search.html
61. IntelliJ IDEA: Update dependencies • Hover https://www.jetbrains.com/help/idea/package-analysis.html
62. IntelliJ IDEA: Update dependencies • Context Actions (⌥ ⏎ or Alt+Enter)
63. IntelliJ IDEA https://www.jetbrains.com/help/idea/package-analysis.html • Vulnerable Dependencies
64. IntelliJ IDEA • Vulnerable Path / Exploitable Path https://www.jetbrains.com/help/idea/package-analysis.html#find-vulnerable-api
65. IntelliJ IDEA • Vulnerable Path / Exploitable Path https://www.jetbrains.com/help/idea/package-analysis.html#find-vulnerable-api
66. IntelliJ IDEA • Vulnerable Path / Exploitable Path https://www.jetbrains.com/help/idea/package-analysis.html#find-vulnerable-api
67. IntelliJ IDEA • Vulnerable Path / Exploitable Path https://www.jetbrains.com/help/idea/package-analysis.html#find-vulnerable-api
68. IntelliJ IDEA • Vulnerable Path / Exploitable Path https://www.jetbrains.com/help/idea/package-analysis.html#find-vulnerable-api
69. Pros & Cons + Check dependencies while working on the project - Check out each individual project - Apply & verify updates
70. Software Composition Analysis (SCA) • Scan all repos (and containers) • Overview
71. SCA: Pros & Cons + No need to check out repos individually - I have to check the dashboard - Apply & verify updates
72. Bots • Dependabot • Renovate • Snyk Open Source
73. Dependabot • GitHub native • Features: • Alerts • Security updates • Version updates
74. Dependabot enable
75. Dependabot alerts https://docs.github.com/en/code-security/dependabot/dependabot-alerts/about-dependabot-alerts
76. Dependabot alerts https://docs.github.com/en/code-security/dependabot/dependabot-alerts/about-dependabot-alerts
77. Dependabot security updates https://docs.github.com/en/code-security/dependabot/dependabot-security-updates/about-dependabot-security-updates
78. Dependabot version updates • Add dependabot.yml • Specify: • Package manager & location of manifest file • Schedule interval (daily, weekly, or monthly) • Optional: • Max. number of PR's (default 5) • Rebase strategy • Etc https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/about-dependabot-version-updates
79. Dependabot: Supported platforms • GitHub native • Can run on GitLab too
80. Renovate • Available via GitHub App • Features: • Security updates • Version updates • Project dashboard
81. Renovate enable https://github.com/apps/renovate
82. Renovate enable - 3
83. Renovate onboarding PR
84. Renovate configuration • All repos or selected repos • Config file is created for you • Scheduling • Max. number of PR's / concurrent branches • Rule based auto merge • More options & more fine-grained https://docs.renovatebot.com/configuration-options/
85. Renovate PR https://docs.renovatebot.com/merge-confidence/
86. Renovate Dashboard: Project
87. Renovate: Supported platforms • GitHub (.com and Enterprise Server) • GitLab (.com and CE/EE) • Bitbucket Cloud • Bitbucket Server • Azure DevOps • AWS CodeCommit • Gitea and Forgejo https://docs.renovatebot.com/#supported-platforms
88. Snyk Open Source • Available via Snyk • Features: • Security updates • Version updates • Dashboards • Test for new vulnerabilities (on PRs) • Test for vulnerabilities in source code https://snyk.io/
89. Snyk enable https://snyk.io/
90. Snyk enable https://snyk.io/
91. Snyk enable https://snyk.io/
92. Snyk enable https://snyk.io/
93. Snyk enable https://snyk.io/
94. Snyk PR
95. Snyk PR
96. Snyk PR Check
97. Snyk dashboard
98. Snyk Open Source Configuration • Frequency (daily, weekly, never) • Enable/disable: New and/or known vulnerabilities • Enable/disable PR's for single project https://docs.snyk.io/products/snyk-open-source/open-source-basics
99. Snyk Open Source: Supported Platforms • GitHub • GitHub Enterprise • GitHub Read-only projects • Bitbucket Cloud Personal Access Token (Legacy) • Bitbucket Cloud App • Bitbucket Data Center/Server • GitLab • Azure (TFS) Repos https://docs.snyk.io/integrations/git-repository-scm-integrations
100. Bots • Dependabot • Renovate • Snyk Open Source
101. Bots: Pros & Cons + Relatively easy to install + Automatic PR's - Can create "noise" - Manage PRs (merge & deploy) - Do NOT update your code (if needed)
102. Migration tools
103. IntelliJ IDEA • Refactor > Migrate Packages and Classes https://www.jetbrains.com/help/idea/migrate.html
104. IntelliJ IDEA • Refactor > Migrate Packages and Classes > • Java EE to Jakarta EE • JUnit (4.x -> 5.0) • JavaFX (8 -> 9) https://www.jetbrains.com/help/idea/migrate.html
105. IntelliJ IDEA • Create New Migration
106. IntelliJ IDEA • Create New Migration
107. Error Prone • Static analysis tool for Java to catch common programming mistakes at compile-time. • Maven, Gradle, etc. • IntelliJ IDEA / Eclipse plugin, Command line • Bug patterns • Report or fix • Custom checks • Includes Refaster: refactor code using before-and-after templates https://errorprone.info/
108. OpenRewrite • Source code refactoring for framework/API migrations, vulnerability patches, and static code analysis fixes • Java, Kotlin & Groovy support • Run using Maven/Gradle plugin • or from a yaml file https://docs.openrewrite.org/
109. OpenRewrite • Existing recipes • Upgrade versions • Migrate libraries • Fix static analysis issues https://docs.openrewrite.org/running-recipes/popular-recipe-guides
110. OpenRewrite • Existing recipes • Find by topic https://docs.openrewrite.org/reference/recipes
111. OpenRewrite • Existing recipes • Can author your own recipes https://docs.openrewrite.org/
112. OpenRewrite support in IntelliJ IDEA
113. OpenRewrite support in IntelliJ IDEA • For example:
114. OpenRewrite support in IntelliJ IDEA
115. Conclusion •(Re)evaluate dependencies carefully •Use the tools you have! •Automate checks & updates as much as possible •Stay safe!
116. Slides & More https://maritvandijk.com/presentations/keep-your-dependencies-in-check/