Name: Solving the Phantom Dependency Problem for Python Packages - Seth Larson, Python Software Foundation
Start: 2025-06-24T15:05:00-0600
End: 2025-06-24T15:45:00-0600

June 23 - 25, 2025
Denver, Colorado
View More Details & Registration
Note: The schedule is subject to change.

The Sched app allows you to build your schedule but is not a substitute for your event registration. You must be registered for Open Source Summit North America 2025 to participate in the sessions. If you have not registered but would like to join us, please go to the event registration page to purchase a registration.

This schedule is automatically displayed in Mountain Daylight Time (UTC/GMT -6). To see the schedule in your preferred timezone, please select from the drop-down menu to the right, above "Filter by Date."

IMPORTANT NOTE: Timing of sessions and room locations are subject to change.

Tuesday June 24, 2025 3:05pm - 3:45pm MDT

Bluebird Ballroom 2E

Endor Labs coined the term "Phantom Dependency Problem" to describe dependencies that are bundled into software packages but not represented in the package metadata. This is common in many software package ecosystems, but it is most prevalent in the Python package ecosystem (PyPI) where many packages include compiled C, C++, and Rust dependencies.

Bundled software not being included in package metadata is meaning means that software composition analysis (SCA), SBOM, and vulnerability scanning tools are not able to detect the bundled software. This can cause vulnerabilities to be missed and make.

The Security Developer-in-Residence at the Python Software Foundation, Seth Larson, worked on solving to the Phantom Dependency problem for Python packaging, involving work on standards and tooling.

By the end of this session attendees will understand the Phantom Dependency problem, how it relates to Python and other packaging ecosystems, how SBOM and SCA tools work, and what work was done to make bundled dependencies measurable and what that means for users.

Speakers

Seth Larson

Security Developer-in-Residence, Python Software Foundation

Seth is the Security Developer-in-Residence at the Python Software Foundation working to improve the security posture of the Python ecosystem. Seth maintains widely used open source Python projects like urllib3, truststore, and Requests.

Tuesday June 24, 2025 3:05pm - 3:45pm MDT
Bluebird Ballroom 2E

Wildcard

Audience Experience Level Intermediate

Open Source Summit North America 2025

Seth Larson

Sign up or log in to save this to your schedule, view media, leave feedback and see who's attending!