Read on Twitter
Motivation
- Keeping dependencies up2date is not easy.
- Breaking changes are problematic for dependants.
- Informally specified and difficult to check against your project
- general tools don't assist with changes.
- Keeping dependencies up2date is not easy.
- Breaking changes are problematic for dependants.
- Informally specified and difficult to check against your project
- general tools don't assist with changes.
Research challenges
- we fully trust the dependencies ecosystem.
- supply chain is reported to be full of vulnerabilities, how does a maintainer interpret this? 95% false positives?
- we fully trust the dependencies ecosystem.
- supply chain is reported to be full of vulnerabilities, how does a maintainer interpret this? 95% false positives?
- maybe my project doesn't use the vulnerable part of the supply chain? We need fine-grained dependency analysis!
- Check out htpps://coana.tech
- Check out htpps://coana.tech
- Given a formal description of the breaking changes, JSFix can automatically update the dependants.
jsfix.live
jsfix.live
• • •
Missing some Tweet in this thread? You can try to
force a refresh
