Non Vulnerable Package Dependency Resolution

The talk starts from a familiar problem: package managers such as apt, pip, poetry and Maven fetch packages and pick versions that satisfy the constraints of other packages, but that process does not check whether the chosen version is vulnerable. The speaker notes that CVE records describe affected version ranges in intricate ways, and that vulnerability databases often disagree about those ranges.

To bridge this gap, the speaker walks through several pieces. Package URL offers a common identifier for a package across ecosystems. A proposed VERS notation aims to express version ranges the same way for every package manager, which is harder than it sounds given how much the ecosystems differ. A tool called python-inspector performs dependency resolution without installing anything, and a vulnerability database keyed by package URLs tracks non-vulnerable version ranges rather than only vulnerable ones.

Combining functional dependency constraints with known vulnerable ranges inside the resolver is what the speaker calls non-vulnerable dependency resolution. A proof of concept feeds vulnerability data and package versions into that process so that vulnerable releases are avoided during selection. The talk closes with a data point: roughly 30 percent of installations of a popular Java logging library still run vulnerable versions, nearly two years after its disclosure. The takeaway is that this kind of resolution could become a standard feature of package management clients.