Dependency Versioning in the Wild

Dietrich, Jens; Pearce, David J.; Stringer, Jacob; Tahir, Amjed; Blincoe, Kelly

doi:10.1109/msr.2019.00061

Cited by 60 publications

(25 citation statements)

References 33 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Xavier, Hora, and Valente note that developers deliberately make breaking changes to APIs for several reasons related to code maintenance [23]. Further, developers struggle with different options for specifying dependency versions that are supported by many package management systems [24], [25], and analysis of such systems motivates the need for better tooling to deal with problems related to versions [26].…”

Section: Related Workmentioning

confidence: 99%

V2: Fast Detection of Configuration Drift in Python

Horton

Parnin

2019

2019 34th IEEE/ACM International Conference on Automated Software Engineering (ASE)

View full text Add to dashboard Cite

Code snippets are prevalent, but are hard to reuse because they often lack an accompanying environment configuration. Most are not actively maintained, allowing for drift between the most recent possible configuration and the code snippet as the snippet becomes out-of-date over time. Recent work has identified the problem of validating and detecting out-of-date code snippets as the most important consideration for code reuse. However, determining if a snippet is correct, but simply out-of-date, is a non-trivial task. In the best case, breaking changes are well documented, allowing developers to manually determine when a code snippet contains an out-of-date API usage. In the worst case, determining if and when a breaking change was made requires an exhaustive search through previous dependency versions.We present V2, a strategy for determining if a code snippet is out-of-date by detecting discrete instances of configuration drift, where the snippet uses an API which has since undergone a breaking change. Each instance of configuration drift is classified by a failure encountered during validation and a configuration patch, consisting of dependency version changes, which fixes the underlying fault. V2 uses feedback-directed search to explore the possible configuration space for a code snippet, reducing the number of potential environment configurations that need to be validated. When run on a corpus of public Python snippets from prior research, V2 identifies 248 instances of configuration drift.

show abstract

Section: Related Workmentioning

confidence: 99%

V2: Fast Detection of Configuration Drift in Python

Horton

Parnin

2019

2019 34th IEEE/ACM International Conference on Automated Software Engineering (ASE)

View full text Add to dashboard Cite

show abstract

“…The design of the npm package manager encourages automatic updates and favors ease of publishing packages [11]. Package dependencies can be pinned down to specific versions or defined as version ranges [20,26,62]; the use of ranges to automatically install minor updates is very common [15,26,40,82].…”

Section: Thmentioning

confidence: 99%

Containing Malicious Package Updates in npm with a Lightweight Permission System

Ferreira

Jia

Sunshine

et al. 2021

2021 IEEE/ACM 43rd International Conference on Software Engineering (ICSE)

View full text Add to dashboard Cite

The large amount of third-party packages available in fast-moving software ecosystems, such as Node.js/npm, enables attackers to compromise applications by pushing malicious updates to their package dependencies. Studying the npm repository, we observed that many packages in the npm repository that are used in Node.js applications perform only simple computations and do not need access to filesystem or network APIs. This offers the opportunity to enforce least-privilege design per package, protecting applications and package dependencies from malicious updates. We propose a lightweight permission system that protects Node.js applications by enforcing package permissions at runtime. We discuss the design space of solutions and show that our system makes a large number of packages much harder to be exploited, almost for free.

show abstract

“…Software dependency management has inherent complexities [18]- [22], [74]- [95]. Blincoe et al [75] studied over 70 million dependencies to find out how developers declared dependencies across 17 package managers. Their results guided research into better practices for dependency management.…”

Section: Re L a T E D Wo R Kmentioning

confidence: 99%

Hero: On the Chaos When PATH Meets Modules

Wang

Qiao

et al. 2021

2021 IEEE/ACM 43rd International Conference on Software Engineering (ICSE)

View full text Add to dashboard Cite

Ever since its first release in 2009, the Go programming language (Golang) has been well received by software communities. A major reason for its success is the powerful support of library-based development, where a Golang project can be conveniently built on top of other projects by referencing them as libraries. As Golang evolves, it recommends the use of a new library-referencing mode to overcome the limitations of the original one. While these two library modes are incompatible, both are supported by the Golang ecosystem. The heterogeneous use of library-referencing modes across Golang projects has caused numerous dependency management (DM) issues, incurring reference inconsistencies and even build failures. Motivated by the problem, we conducted an empirical study to characterize the DM issues, understand their root causes, and examine their fixing solutions. Based on our findings, we developed HE R O , an automated technique to detect DM issues and suggest proper fixing solutions. We applied He r o to 19,000 popular Golang projects. The results showed that HE R O achieved a high detection rate of 98.5% on a DM issue benchmark and found 2,422 new DM issues in 2,356 popular Golang projects. We reported 280 issues, among which 181 (64.6%) issues have been confirmed, and 160 of them (88.4%) have been fixed or are under fixing. Almost all the fixes have adopted our fixing suggestions. Index Terms-Golang Ecosystem, Dependency Management'The Vendor attribute allows a Golang project to reference a library's different versions and keep them in different folders under a vendor directory.

show abstract

Dependency Versioning in the Wild

Cited by 60 publications

References 33 publications

V2: Fast Detection of Configuration Drift in Python

V2: Fast Detection of Configuration Drift in Python

Containing Malicious Package Updates in npm with a Lightweight Permission System

Hero: On the Chaos When PATH Meets Modules

Contact Info

Product

Resources

About