Managing Software Dependency Risks in Web Applications