MENU
You are designing the security validation strategy for a project in Azure DevOps.
You need to identify package dependencies that have known security issues and can be resolved by an
update.
What should you use?
12 comments · newest first
DO
Dorathy
12 months ago
Jenkins has some plugins for this, but not as effective as SonarQube.
JU
Junita
1 year ago
Wait, can Gradle even check for security issues?
CH
Chun
1 year ago
Definitely going with SonarQube here!
MA
Marshall
1 year ago
Octopus Deploy? Not really for this purpose.
GE
Genevieve
1 year ago
I think SonarQube is the best choice for identifying security issues.
RA
Raelene
1 year ago
Octopus Deploy seems more focused on deployment rather than identifying security vulnerabilities. I think SonarQube is the best fit for this scenario.
CH
Chi
1 year ago
I practiced a question similar to this, and I feel like Gradle could help with dependency management, but I'm not confident it checks for security issues.
ED
Edward
1 year ago
I'm not entirely sure, but I remember Jenkins being used for CI/CD. Does it also handle security issues in packages?
RE
Refugia
1 year ago
I think SonarQube might be the right choice here since it analyzes code quality and can identify vulnerabilities in dependencies.
MA
Mabelle
1 year ago
Hmm, I'm a bit unsure about this one. I know Salesforce has a lot of features related to leads, but I'll need to think through which ones are specifically relevant for this use case.
AL
Alfreda
1 year ago
Hmm, I'm a bit unsure about this one. I know the Search and Replace Names tool is used for renaming, but I can't quite recall if it's for single objects, multiple objects, or something else. I'll have to think this through carefully.
CE
Celestine
1 year ago
Okay, I think I've got a strategy here. The key is understanding that bitmap indexes store data in a compressed format, and DML operations can disrupt that compression. I'll focus on how the locking and rebuilding of the index segments impacts performance.