Here are the slides for the presentation that I gave at PyGeekle 2022, A Deep Dive into Measuring Dependency Freshness with LibYear.

1. @mscottford
MEASURING DEPENDENCY FRESHNESS
BY M. SCOTT FORD
CO-FOUNDER & CEO, CORGIBYTES
A DEEP DIVE INTO
USING LIBYEAR

2. @mscottford
HI.

3. @mscottford
HI.
I’M SCOTT.

4. @mscottford
HI.
I LOVE TO FIX BUGS.
I’M SCOTT.

5. @mscottford
AND
DEPENDENCIES.
UPGRADE

6. @mscottford
Source: https://arstechnica.com/information-technology/2017/09/massive-equifax-breach-caused-by-failure-to-patch-two-month-old-bug/

7. @mscottford
WHY DOES THIS HAPPEN?
Photo credit: https://www.flickr.com/photos/mharrsch/402046838

8. @mscottford
WHY DOES THIS HAPPEN?
• Fear
Photo credit: https://www.flickr.com/photos/mharrsch/402046838

9. @mscottford
WHY DOES THIS HAPPEN?
• Fear
• Time
Photo credit: https://www.flickr.com/photos/mharrsch/402046838

10. @mscottford
WHY DOES THIS HAPPEN?
• Fear
• Time
• Priorities
Photo credit: https://www.flickr.com/photos/mharrsch/402046838

11. @mscottford
WHY DOES THIS HAPPEN?
• Fear
• Time
• Priorities
• Perceived difficulty
Photo credit: https://www.flickr.com/photos/mharrsch/402046838

12. @mscottford
WHY DOES THIS HAPPEN?
• Fear
• Time
• Priorities
• Perceived difficulty
• Invisible problem
Photo credit: https://www.flickr.com/photos/mharrsch/402046838

13. @mscottford
DEPENDENCY
FRESHNESS
Source: Measuring Dependency Freshness in Software Systems by J. Cox et al. (ICSE 2015), May 2015 https://ericbouwers.github.io/papers/icse15.pdf @mscottford

14. @mscottford
IT’S LIKE
BRUSHING
YOUR TEETH @mscottford

15. @mscottford
MINTY FRESH
SOFTWARE
@mscottford

16. @mscottford
BRUSH
YOUR TEETH
Source: Measuring Dependency Freshness in Software Systems by J. Cox et al. (ICSE 2015), May 2015 https://ericbouwers.github.io/papers/icse15.pdf @mscottford
OUT OF DATE DEPENDENCIES
HAVE CONSEQUENCES @mscottford

17. @mscottford
FOR DEVS
@mscottford

18. @mscottford
• Difficult to work with
FOR DEVS
@mscottford

19. @mscottford
• Difficult to work with
• Docs are hard to find
FOR DEVS
@mscottford

20. @mscottford
• Difficult to work with
• Docs are hard to find
• Support is lacking
FOR DEVS
@mscottford

21. @mscottford
FOR ORGS

22. @mscottford
FOR ORGS
• Developer productivity

23. @mscottford
FOR ORGS
• Developer productivity
• Significant security
risks

24. @mscottford
FOR ORGS
• Developer productivity
• Significant security
risks
• PR fallouts or loss of
customer trust

25. @mscottford
LIBYEAR
Source: https://libyear.com/

26. @mscottford
Source: https://libyear.com/ @mscottford

27. @mscottford
WHY LIBYEAR?

28. @mscottford
WHY LIBYEAR?
• Easy to compute

29. @mscottford
WHY LIBYEAR?
• Easy to compute
• Distills dependency risk as a
single number

30. @mscottford
WHY LIBYEAR?
• Easy to compute
• Distills dependency risk as a
single number
• Easy to communicate

31. @mscottford
WHY LIBYEAR?
• Easy to compute
• Distills dependency risk as a
single number
• Easy to communicate
• Provides even more value when
graphed over time

32. @mscottford
HOW TO MEASURE
MANUALLY

33. @mscottford
LATEST VERSION: RELEASE DATE
CURRENT VERSION: RELEASE DATE
–
=
PACKAGE LIBYEAR
LIBYEAR: SINGLE PACKAGE
@mscottford

34. @mscottford
PACKAGE(0).LIBYEAR +
PACKAGE(1).LIBYEAR +
PACKAGE(N).LIBYEAR
…
=
PROJECT LIBYEAR
LIBYEAR: ENTIRE PROJECT
@mscottford

35. @mscottford
HOW TO MEASURE
AUTOMATED

36. @mscottford
Source: https://github.com/nasirhjafri/libyear

37. @mscottford
EXAMPLE
PYSPIDER

38. @mscottford

39. @mscottford
HOW TO MEASURE
AUTOMATED – CHANGES OVER TIME

40. @mscottford
Source: https://github.com/corgibytes/freshli

41. @mscottford
Source: https://github.com/corgibytes/freshli

42. @mscottford
Source: https://freshli.io

43. @mscottford
EXAMPLE
PYSPIDER

44. @mscottford
Source: https://freshli.io/AnalysisRequests/7a0ec83f-d661-441f-8b24-0727913b6eb2

45. @mscottford
Source: https://freshli.io/AnalysisRequests/7a0ec83f-d661-441f-8b24-0727913b6eb2

46. @mscottford
EXAMPLE
NETBOX

47. @mscottford
Source: https://freshli.io/AnalysisRequests/022361bf-5e66-47bb-a565-559e713e5157

48. @mscottford
Source: https://freshli.io/AnalysisRequests/022361bf-5e66-47bb-a565-559e713e5157

49. @mscottford
Source: https://freshli.io/AnalysisRequests/022361bf-5e66-47bb-a565-559e713e5157

50. @mscottford
Source: https://github.com/netbox-community/netbox/blob/d29d265b0aadda0913c46904d829d1b7ddc8a82e/requirements.txt

51. @mscottford
FRESHLI’S STATUS
PROOF OF CONCEPT
Developing support for analyzing
private repositories and making it
easier to add support for
new ecosystems
FOCUS
Demo https://freshli.io is live and
supports collecting metrics for
public repositories

52. @mscottford
FRESHLI’S FUTURE
MISSION VISION
Create tools that clearly illustrate
the financial risk of
deferred software maintenance.
Software systems are self-healing
and outdated dependencies
are a thing of the past.

53. @mscottford
BEST NEXT STEPS

54. @mscottford
BEST NEXT STEPS
• Finish support for private
repositories

55. @mscottford
BEST NEXT STEPS
• Finish support for private
repositories
• Develop metric that considers
security risk

56. @mscottford
BEST NEXT STEPS
• Finish support for private
repositories
• Develop metric that considers
security risk
• Add security vulnerability
information to graphs

57. @mscottford
GET INVOLVED

58. @mscottford
GET INVOLVED
• github.com/corgibytes/freshli

59. @mscottford
GET INVOLVED
• github.com/corgibytes/freshli
• Add more metrics

60. @mscottford
GET INVOLVED
• github.com/corgibytes/freshli
• Add more metrics
• Support more ecosystems and
dependency formats

61. @mscottford
DEPENDENCIES
AUTO-UPGRADING
IS ACHIEVABLE

62. @mscottford
THANK YOU!

63. @mscottford
CONTACT INFO
M. SCOTT FORD
scott@corgibytes.com
@mscottford
in/mscottford
804-596-2375 x701