Managing Transitive Dependencies in Open Source Software

Insights and Essential Practices

Simple software applications may have only a few dependencies, perhaps a handful of libraries or frameworks. But an enterprise-level system or a large web application can have thousands of dependencies, many of them indirect or transitive. These dependencies can create complex chains that are nearly impossible to detect, manage, and test without automated tooling.

The latest “Open Source Security and Risk Analysis” (OSSRA) report includes several key findings that highlight the importance of identifying and tracking transitive dependencies.

• Prevalence: 64% of the open source components identified in the OSSRA report were transitive dependencies
• Complexity: Open source software is more complex than ever, and the number of open source files in an average application has increased three-fold since 2020
• Security risks: 81% of codebases contain high- or critical-risk vulnerabilities, nearly half of which were introduced by transitive dependencies
• License conflicts: 56% of codebases have license conflicts, the majority caused by incompatible transitive dependencies

But the very nature of transitive dependencies make them difficult to locate, track, and manage. This white paper discusses five common problems and risks associated with transitive dependencies in open source software, and it provides nine essential practices for avoiding or overcoming those pitfalls.

Download the white paper to understand

• How to gain visibility into transitive dependencies
• Why automation is key to managing transitive dependencies
• How to evaluate and track IP and license obligations
• How to generate and validate Software Bills of Materials
• What role package managers play in managing transitive dependencies