Questions tagged [dependency-management]
The dependency-management tag has no summary.
13 questions
0 votes
0 answers
28 views
Ever Since I updated Docker, my dependency-track instance abends on startup
My team runs a local Docker instance on one of its scratch PCs, and for the last year and a half, I've been using it to do SBOM analysis using Dependency-Track. Last week, I successfully ran an ...
1 vote
1 answer
548 views
Best practices for managing Github actions + workflows in an organization?
In my organization, we have more than a hundred repos, most of them use their own workflows but also reusable workflows that are located in a designated repo, that also holds all of our self made ...
- 11
3 votes
1 answer
2k views
Why do companies use JFrog Artifactory or other repositories instead of Maven central repository?
I have usually seen that when someone uses Maven on a company network to download dependencies, then user is redirected to the JFrog Artifactory or any other, instead of downloading dependencies from ...
- 31
1 vote
1 answer
235 views
Cannot understand jenkins deployment error
I am new to jenkins, and i am trying to make a deployment into a remote serve, but i am getting the following error: Current dependency:com.vmd positionWatchLoader latest.integration :: loading ...
- 121
14 votes
2 answers
4k views
Does `npm audit` add any value when using `dependabot`
Context There are multiple ways to scan projects for vulnerabilities. Dependabot can be configured to check repositories for issues, and automatically submits pull requests to resolve. NPM Audit will ...
- 315
0 votes
0 answers
1k views
How can I ensure Helm doesn't install a dependency twice?
If I have a chart, say ChartA, that has a dependency on ChartB, I want to only install ChartB if it hasn't been installed already. Why? Let's say I run 2 copies of ChartA, and they both need a ...
- 79
2 votes
1 answer
248 views
What package managers are supported on Microsoft hosted agents with CMake enabled?
Here, I can read that it is possible to setup a CMake build on a Microsoft hosted vsts agent. What C++ package managers (e.g. Conan) are supported for these agents? It would be great if at least one ...
- 131
6 votes
1 answer
551 views
Build Design - Docker vs Fedora's Mock
This post is migrated from a reddit post. Parts in bold are to adopt it to SE's format. I'm talking with companies to help streamline/combine their build process. They must do it together and their ...
- 466
3 votes
2 answers
213 views
Mitigating Maven Central risks as seen from the DevSecOps perspective
AFAIK there are two official primary repositories for Maven packages (Java language): search.maven.org offered by Sonatype Inc. mvnrepository.com offered by a private person @frodriguez Now obviously ...
- 6,792
12 votes
1 answer
2k views
What is recommended to document an IT technology stack, including their relationship to one another, in a graph database?
Working for a large company with over 500 IT staff and over a 1,000 servers, with each server running its own business applications, we have a tremendous information and co-ordination challenge in ...
- 156
4 votes
1 answer
76 views
Using requisite injection to order states
Given three states, /root/a, /root/b and /root/c, I want /root/c to execute before /root/b, and /root/b to execute before /root/a. Given a Salt SLS file salt://ordertest/init.sls: /root/a: file....
- 1,045
7 votes
2 answers
1k views
Constructing Dependencies from a Pillar in Saltstack
I'm trying to create a dummy state in Salt to pull dependencies from a list derived from a pillar. In my top.sls file, I have: base: '*': - components Then, in components.sls, I have: {% if '...
- 1,045
5 votes
2 answers
1k views
How to manage Free and Open Source Software dependencies?
We exist in an increasingly complex ecosystem of Free and Open Source Software, FOSS, and it's dependencies. Having done a bit of analysis on one medium size project there are over 1,500 dependent ...
- 11.8k