New Approach to Open-Source Software Supply Chain Security with Secured Packages

The video addresses challenges in managing open-source software supply chain security, where 70-90% of application code relies on third-party dependencies. Traditional approaches—automated patching or version pinning—either risk breaking changes or accumulate unpatched vulnerabilities (CVEs), exacerbated by AI-driven vulnerability discovery accelerating the pace of new threats. A new class of tools, termed 'secured packages' or 'certified patches,' surgically backports security fixes to pinned dependency versions without altering functionality, avoiding breaking changes. Companies like Root employ an 'agentic software factory' combining AI agents and human experts to autonomously identify and backport fixes across multiple older versions of open-source libraries. This method contrasts with end-of-life support (ELS) services, which are limited in scale, by enabling large-scale vulnerability remediation for any dependency. The demonstration shows integration with Akita Security’s dashboard, where vulnerable packages can be replaced with pre-patched versions while preserving application stability. The solution is particularly valuable for dependencies with breaking changes in newer releases.