Dependency analytics 1.0: AI coding with supply chain security (developers.redhat.com)

Dependency analytics 1.0 has been launched as an open-source extension for editors like VS Code, tackling a significant issue in the AI programming landscape: the security vulnerabilities introduced by AI-generated code. While tools like GitHub Copilot boost developer productivity by allowing them to generate code quickly, recent findings indicate that 45% of this AI-produced code contains security flaws. Dependency analytics addresses this by scanning a project's dependencies in real-time as developers write code, flagging any known vulnerabilities and suggesting safer alternatives, thereby integrating security directly into the coding workflow. The extension supports popular programming ecosystems, including JavaScript/TypeScript, Python, Java, Go, and Rust, and operates without requiring developers to perform additional security scans. Given that AI agents often rely on outdated patterns during their code generation, dependency analytics acts as a vital guardrail, ensuring that developers can maintain high productivity while safeguarding their applications against vulnerabilities. With over three million installs, this extension is already one of the leading tools for enhancing supply chain security in development environments, promoting a safer adoption of AI coding technologies.