Gestion des dépendances

[bbaudry]

Resources qui traitent de l'impact des dépendances sur la qualité logicielle

Exemple de fichier de dépendances pour le projet gdext

[workspace]
resolver = "2"
members = [
    "godot-bindings",
    "godot-codegen",
    "godot-ffi",
    "godot-core",
    "godot-macros",
    "godot-cell",
    "godot",

    # Godot integration
    "itest/rust",
    "itest/repo-tweak",
    "examples/dodge-the-creeps/rust",
    "examples/hot-reload/rust",
]

[FR] gestion des dépendances

[bbaudry]

[FR] gestionnaire de paquets

[bbaudry]

Mise à jour de dépendances

• [FR] dependabot
• renovate

[bbaudry]

gestionnaires de dépendances

• Java: Maven, Gradle
• JavaScript: npm
• Rust: cargo
• OCaml: opam
• Python: pip

[bbaudry]

réduction des dépendances

• tree shaking in JS
• Maven shade in Java
• cargo-udeps in Rust
• gem_bench in Ruby

[bbaudry]

Automating dependency updates in practice: An exploratory study on github dependabot

[bbaudry]

BUMP: A Benchmark of Reproducible Breaking Dependency Updates

[bbaudry]

What NPM Should Do Today To Stop A New Colors Attack Tomorrow

[bbaudry]

Hash-Based Bisect Debugging in Compilers and Runtimes

[bbaudry]

On the impact of security vulnerabilities in the npm and RubyGems dependency networks

[bbaudry]

Dependency update strategies and package characteristics

[bbaudry]

Characterizing Dependency Update Practice of NPM, PyPI and Cargo Packages

[bbaudry]

Push and pull: when and why to update your dependencies

[bbaudry]

The Risks and Benefits of Updating Dependencies

[bbaudry]

Revival Hijack – PyPI hijack technique exploited in the wild, puts 22K packages at risk