Vulnerable dependencies
On This Lesson 4 topics
This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.
In this lesson
find and fix known-vulnerable libraries.
Planned topics
- Most of your running code is libraries; each can have known flaws (CVEs).
- Scanners compare your dependency list with vulnerability databases: OWASP Dependency-Check, or GitHub Dependabot alerts and update pull requests.
- Run the scan in the build and fail it above a chosen severity.
- Update regularly in small steps; the tests tell you if it broke.
- Triage every warning: fix, or record why it is not exploitable. Do not ignore forever.
Draft outline details
Demonstration
a CI step that runs the scanner and a Dependabot config file for Maven or Gradle (verify the syntax before recording).
Check your understanding
What should you do with a scanner warning?
Show answer
Fix it or document why it does not apply, with a review date.
Practice
Apply this lesson with the module's lab, exercises and quiz.
Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.