Software Maintenance: Scenario-Based Questions

Third-party libraries accelerate development but introduce risks — security vulnerabilities, license issues, and upgrade fatigue. A strong dependency management strategy balances velocity with control.

🔍 Risk Categories

• Security: Vulnerabilities in outdated packages (e.g., CVEs).
• Licensing: GPL vs MIT or commercial usage restrictions.
• Stability: Breaking API changes or deprecated projects.

🧰 Tooling & Automation

• Dependency Scanners: Snyk, Dependabot, Renovate, OSV Scanner.
• SBOM: Generate Software Bill of Materials (CycloneDX, SPDX) for audits.
• Lockfiles: Use lockfiles to ensure reproducibility across environments.
• License Auditing: Tools like FOSSA, LicenseFinder.

📦 Dependency Governance Practices

• Define an “allowed” list and review additions with an approval process.
• Pin exact versions and avoid implicit upgrades.
• Automate patch updates but gate major upgrades via CI tests.
• Regularly prune unused or deprecated packages.

✅ Best Practices

• Review third-party usage during design/review cycles.
• Separate core infra packages from transient or app-specific ones.
• Subscribe to mailing lists or GitHub notifications for key dependencies.
• Include dependency scanning in CI pipelines.

🚫 Common Pitfalls

• Blindly trusting latest versions from open source registries.
• Allowing transitive dependencies to go unchecked.
• Ignoring supply chain risks (e.g., malicious NPM uploads).

📌 Final Insight

Managing third-party code is part of building software responsibly. The right mix of automation, policy, and developer awareness can keep your stack secure, legal, and maintainable.