As demonstrated by much talked about events such as the LeftPad incident, which led to hundreds of thousands of websites to stop working, and the Equifax data breach, which led to a leak of hundreds of thousands of credit card numbers, dependencies on networks of external libraries can introduce significant operational and compliance risks as well as difficulties to assess security implications. Most development teams still fail to adequately inventory their software dependencies. Even as more code is produced, indirect dependencies continue to undermine security and account for the majority of vulnerabilities.

What have been the recent progresses in dependency management made available to developers? What are the remaining key challenges? What future improvements can we expect from industry or from research?

This Devroom aims to establish the state of the art in dependency management, it builds upon the success of last year’s Devroom to which it will constitute a welcome update.