Dependency Vulnerability Management

This thread tracks the evolution of Slack's systems for managing and mitigating security vulnerabilities in external dependencies. Initial efforts focused on identifying vulnerabilities in Javascript/npm packages. This post details the development of a tool to detect vulnerabilities, track their remediation status, and notify owners. It evolved to include support for Hack and Go, and to visualize dependency trees using force graphs to identify direct dependencies and prioritize fixes. Future work includes improving the signal-to-noise ratio and refining remediation strategies.