Gestion des dépendances

[bbaudry]

Resources qui traitent de l'impact des dépendances sur la qualité logicielle

Exemple de fichier de dépendances pour le projet gdext

[workspace]
resolver = "2"
members = [
    "godot-bindings",
    "godot-codegen",
    "godot-ffi",
    "godot-core",
    "godot-macros",
    "godot-cell",
    "godot",

    # Godot integration
    "itest/rust",
    "itest/repo-tweak",
    "examples/dodge-the-creeps/rust",
    "examples/hot-reload/rust",
]

[FR] gestion des dépendances

[bbaudry]

[FR] gestionnaire de paquets

[bbaudry]

Mise à jour de dépendances

• [FR] dependabot
• renovate

[bbaudry]

gestionnaires de dépendances

• Java: Maven, Gradle
• JavaScript: npm
• Rust: cargo
• OCaml: opam
• Python: pip

[bbaudry]

réduction des dépendances

• tree shaking in JS
• Maven shade in Java
• cargo-udeps in Rust
• gem_bench in Ruby

[bbaudry]

Automating dependency updates in practice: An exploratory study on github dependabot

[bbaudry]

BUMP: A Benchmark of Reproducible Breaking Dependency Updates

[bbaudry]

What NPM Should Do Today To Stop A New Colors Attack Tomorrow

[bbaudry]

Hash-Based Bisect Debugging in Compilers and Runtimes

[bbaudry]

On the impact of security vulnerabilities in the npm and RubyGems dependency networks

[bbaudry]

Dependency update strategies and package characteristics

[bbaudry]

Characterizing Dependency Update Practice of NPM, PyPI and Cargo Packages

[bbaudry]

Push and pull: when and why to update your dependencies

[bbaudry]

The Risks and Benefits of Updating Dependencies

[bbaudry]

Revival Hijack – PyPI hijack technique exploited in the wild, puts 22K packages at risk

[bbaudry]

Nix: A Safe and Policy-Free System for Software Deployment.

Nix

[bbaudry]

[FR] GNU Guix est un gestionnaire de paquets pour GNU/Linux

[bbaudry]

Unikernels are small, lightweight, single address space operating systems with the kernel included as a library within the application.

[bbaudry]

Surviving Software Dependencies

[bbaudry]

Taming behavioral backward incompatibilities via cross-project testing and analysis

[bbaudry]

Find unmaintained packages in Rust projects
https://github.com/trailofbits/cargo-unmaintained

[bbaudry]

poetry pour la gestion de dépendances en python
https://python-poetry.org/docs/

[bbaudry]

Conda provides package, dependency, and environment management for any language

[bbaudry]

Safety checks Python dependencies for known security vulnerabilities and suggests the proper remediations for vulnerabilities detected

[bbaudry]

A case study of developer bots: motivations, perceptions, and challenges, 2023