Keep Your Dependencies in Check • Marit van Dijk • GOTO 2023

This presentation was recorded at GOTO Copenhagen 2023. #GOTOcon #GOTOcph https://gotocph.com Marit van Dijk - Developer Advocate at JetBrains & Open Source Contributor @maritvandijk RESOURCES https://twitter.com/MaritvanDijk77 https://linkedin.com/in/maritvandijk https://mastodon.social/@maritvandijk https://github.com/mlvandijk https://medium.com/@mlvandijk https://maritvandijk.com ABSTRACT If Log4Shell, Spring4Shell, etc. have taught us anything, it’s that we need to keep our dependencies up to date. But updating our applications can take a lot of time. How do we stay on top of that, while also continuing to deliver business value? Luckily, there are plenty of tools that can help us with this, from package managers to bots that can automatically create changes on our repositories. Let’s go over some of the different options, so we can make informed choices about what’s best for us in a particular situation. [...] TIMECODES 00:00 Intro 00:27 Open source software 02:00 Log4j 03:30 Spring4Shell 05:06 Do we need this dependency? 05:33 Selecting dependencies 10:03 Dependency information 12:54 Maintain dependencies 13:06 Maven 15:01 Gradle 15:41 Demo 19:43 IntelliJ IDEA 19:52 Pros & cons 20:23 Software composition analysis 21:45 Dependabot 24:24 Renovate 26:46 Snyk open source 30:17 Bots: Pros & cons 32:02 Migration tools 33:04 Error Prone 34:43 OpenRewrite 36:58 Conclusion 37:14 Outro Download slides and read the full abstract here: https://gotocph.com/2023/sessions/2724 RECOMMENDED BOOKS Mark Seemann & Steven van Deursen • Dependency Injection Principles, Practices & Patterns • https://amzn.to/49dgvjK Heather Meeker • A Practical Guide to Open Source Software Licensing • https://amzn.to/3I029Y6 Mark Seemann • Dependency Injection in .NET • https://amzn.to/3SXAqgX https://twitter.com/GOTOcon https://www.linkedin.com/company/goto- https://www.instagram.com/goto_con https://www.facebook.com/GOTOConferences #Dependencies #OpenSource #Log4j #Spring4Shell #UpdateDependencies #Maven #Gradle #IntelliJ #Dependabot #RenovateBot #Snyk #ErrorProne #OpenRewrite #MaritvanDijk Looking for a unique learning experience? Attend the next GOTO conference near you! Get your ticket at https://gotopia.tech Sign up for updates and specials at https://gotopia.tech/newsletter SUBSCRIBE TO OUR CHANNEL - new videos posted almost daily. https://www.youtube.com/user/GotoConferences/?sub_confirmation=1