Erlend Oftedal -- What You Require, You Must Also Retire

A JavaScript library can keep working long after its security problems become public. Retire.js project leader Erlend Oftedal explains how developers can discover vulnerable dependencies and make that information part of everyday development. He describes the project’s origins, command line scanning, browser-based detection, and options for integrating checks into a build pipeline. Chris probes what happens after a finding, how exceptions can undermine the process, and how externally loaded libraries fit into the picture. They also discuss Retire.js alongside npm auditing, OWASP Dependency-Check, and Dependency-Track. Erlend’s experience leading an OWASP chapter adds a community perspective to the technical discussion. The practical message is to know which libraries you ship and make upgrading them a continuing engineering responsibility.The Application Security Podcast is brought to you by Security Journey.About Security JourneySecurity Journey provides application security education for developers and everyone in the software development lifecycle.→ Learn more about Security JourneyConnect with Erlend Oftedal:→ Erlend Oftedal on LinkedIn→ Retire.jsMentioned in this episode:→ Retire.js source code→ OWASP Dependency-Check→ OWASP Dependency-Track→ OWASP Proactive ControlsFollow the Application Security Podcast:➜ Home➜ X➜ LinkedIn➜ YouTube➜ Instagram➜ FacebookChapters:00:00 Finding vulnerable JavaScript with Erlend Oftedal01:54 A developer’s path into security07:07 Running an OWASP chapter10:27 Why Retire.js was created12:34 Scanning locally and in a pipeline14:16 The danger of ignoring every finding15:29 Reading scan results and the role of npm audit17:45 Upgrading vulnerable libraries19:05 Detecting libraries loaded from other sites20:32 Passive discovery in the browser22:05 Working with Dependency-Check and Dependency-Track24:27 Open-source and commercial dependency tools28:21 The limits of automated coverage