Work in progress -- Discovery: Dependencies vulnerability management tools for release branches

1. Introduction

Objective

• To identify and evaluate tools that specialize in detecting security vulnerabilities and automating security patch applications in dependencies, tailored for release branches within Open edX.

Scope

• Concentrating on tools that are compatible with Open edX’s technology stack and prioritize effectiveness in vulnerability detection and automated patch management.

2. Evaluation Criteria

• Security Vulnerability Detection: Proficiency in identifying vulnerabilities in dependencies.

• Patch Management: Capability to automate the application of security patches.

• Branch Support: Ability to scan across various branches, including release branches.

• Integration Ease: Compatibility with Open edX's CI/CD workflows and existing development tools.

• Reporting and Alerts: Clarity and actionability of vulnerability reports and patch recommendations.

• Cost Effectiveness: Value proposition in relation to cost.

• User Reviews and Community Support: Feedback and support from the developer community.

3. Tools Overview

Renovate

• Description: An open-source tool for automating dependency updates.

• Trigger Mechanism: Renovate continuously monitors dependency files in your repositories and automatically creates pull requests when updates are available. It can be configured to run at specific intervals or in real-time.

• Open edX Specifics: Offers flexibility in managing updates and security patches across various project repositories.

Snyk

• Description: Focuses on vulnerability detection with automated patching capabilities.

• Trigger Mechanism: Provides continuous monitoring of repositories, scanning for vulnerabilities upon code commits, and periodically based on a schedule. It also offers real-time alerts when new vulnerabilities are detected.

• Open edX Specifics: Effective in identifying and addressing security issues in a range of dependency types.

Whitesource

• Description: Specializes in open-source vulnerabilities, offering a free plan.

• Trigger Mechanism: Mend Bolt primarily triggers scans upon code pushes, with a limitation of 5 scans per day per repository. This may limit its real-time monitoring capability.

• Open edX Specifics: Beneficial for focused open-source dependency scanning, especially under budget considerations.

4. Comparative Analysis

6. Conclusion

Renovate and Snyk are highly recommended for their strong capabilities in vulnerability detection and automated patch management. They offer considerable flexibility and comprehensive features suitable for Open edX's release branch requirements. Mend Bolt serves as a cost-effective alternative, particularly effective for managing open-source vulnerabilities.

7. References

1. Renovate:

   • Official Website: https://www.whitesourcesoftware.com/free-developer-tools/renovate/

   • Documentation: https://docs.renovatebot.com/

2. Snyk:

   • Official Website: https://snyk.io/

   • Documentation:

3. Mend Bolt (Formerly WhiteSource Bolt):

   • Official Website:

   • Documentation: https://www.mend.io/resources/documentation/

8. Appendices

Pricing Plan Comparison

Renovate

• Pricing Model: Renovate is an open-source tool and is available for free. There are no direct costs associated with using its basic version.

• Enterprise Version: If there is an enterprise version available, it might come with additional features and support, but also with associated costs. It's advisable to check the latest information on their official website for enterprise offerings.

Snyk

• Free Tier: Snyk offers a free tier, which includes basic features suitable for small projects or individual developers.

• Paid Plans: The pricing for paid plans varies based on the scale of usage, such as the number of developers, tests per month, and advanced features like license compliance management. Snyk often tailors its pricing to the specific needs of the organization, so contacting them for a quote would be necessary.

• Enterprise Solutions: For large organizations like Open edX, Snyk offers enterprise-grade solutions, which include advanced features but at a higher cost.

Mend Bolt (Formerly WhiteSource Bolt)

• Free Plan: Mend Bolt provides a free plan, which is particularly attractive for budget-conscious projects or smaller teams. This plan is focused on open-source vulnerability management.

• Premium Options: If there are premium versions or add-ons, they would come with additional features but also additional costs. Checking Mend's official site for the latest on their premium offerings is recommended.