Automated security and update routine before every release

[hpvd]

Is your enhancement request related to a problem? Please describe.
To get the most out of every release regarding security, performance and "bug-freeness" it may be a good idea to make reasonable updating of dependencies a good routine before every release.

Describe the solution you'd like

what would help (if not already used):

1. enabling GitHubs alerts for vulnerable dependencies for pulsar see https://docs.github.com/en/free-pro-team@latest/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies

-> if possible a bot automatically should open an issue to fix these findings / update the dependencies as soon as fixes are available

2. since possible not all vulnerabilities are reported/found it may also be an idea having a dynamic/automated table of dependencies:
   • column 1: name of dependency
   • column 2: versions of dependencies used in the latest pulsar release e.g. see https://frontbackend.com/maven/artifact/org.apache.pulsar/pulsar/2.6.2
   • column 3: latest version of dependency available (if hosted at GitHub: accessible with GitHub API)

-> before every release one should look at this table and update all (most) dependencies to their latest version (or note a hint why this is not possible at this time (e.g. incompatible changes)
-> of course one could automate open update issues as well, but these may result for too many intermediate steps between releases

[hpvd]

here you can find a blog post with the anoucement of the availability of automatic code scanning for security
https://github.blog/2020-09-30-code-scanning-is-now-available/

[sijie]

@hpvd thank you for reporting this. We will consider it in our future releases.

[hpvd]

A new GitHub feature which may also lead to some kind of "security routine" when merging pull requests, was presented at GitHub Universe 2020: "Dependency Review" :
From announcement:

Dependency review
Today, dependency graph helps you understand your dependencies, and security alerts notify you of newly discovered vulnerabilities in your dependencies. But what if you could receive these alerts before introducing vulnerable code through new or updated dependencies?
Dependency review helps reviewers and contributors understand dependency changes and their security impact at every pull request.

https://github.blog/2020-12-08-new-from-universe-2020-dark-mode-github-sponsors-for-companies-and-more/
also
https://docs.github.com/en/free-pro-team@latest/github/collaborating-with-issues-and-pull-requests/reviewing-dependency-changes-in-a-pull-request

[hpvd]

These points could possibly be classified as "low-hanging fruits" in the field of security (at least if they work as expected and there are not to many false positive findings introduced...)

[hpvd]

as a last point to this topic: it may be also interesting to give GitHub's "super linter" a try and let it check the hole project on every release or on every pull via GitHub action...
see https://github.com/github/super-linter/