> Container scanners and dependency bots like Dependabot are snake oil solutions sold to people too lazy to actually secure their application. Many years ago I

> Container scanners and dependency bots like Dependabot are snake oil solutions sold to people too lazy to actually secure their application. Many years ago I'd have agreed with this so hard I'd hurt myself. These days I've moved on to a much more nuanced "maybe". Also many years ago the code might've had half a dozen dependencies and the developers knew quite well how they were used and what code paths were relevant now or in the near future. So it was fairly tractable to say: Nope, that doesn't impact us, ignore. These days there are thousands of dependencies and if I grab a random developer from the team and ask them "How is libfoo being used?" the response is most likely along the lines of "libfoo? never heard of it" because it was brought in as a third-degree dependency. So is the vulnerable functionality conceivably relevant or not? Nobody in the house knows. In such a world, it is quite often easiest to have a blanket policy of update/patch everything if at all possible. Only if some upgrade causes trouble, then spend human cycles to review and analyze what's up. I've seen teams that try to analyze everything fall further and further behind because vulnerabilities come in faster than they can analyze.