Do developers update their library dependencies?

Kula, Raula Gaikovina; Germán, Daniel M.; Ouni, Ali; Ishio, Takashi; Inoue, Katsuro

doi:10.1007/s10664-017-9521-5

Cited by 265 publications

(161 citation statements)

References 30 publications

Supporting

Mentioning

154

Contrasting

Order By: Relevance

“…They examined 133K websites and found that 37% of these websites use at least one library with a known vulnerability. Kula et al [15] investigated 4,659 GitHub projects and more than 850K library dependency migrations to find developer responsiveness to existing security awareness mechanisms. They found that developers do not tend to update third-party libraries, especially to fix vulnerabilities, while 81.5% of the studied systems remain with outdated dependencies.…”

Section: Security Vulnerabilitiesmentioning

confidence: 99%

On the impact of security vulnerabilities in the npm package dependency network

Decan

Mens

Constantinou

2018

Proceedings of the 15th International Conference on Mining Software Repositories

184

113

View full text Add to dashboard Cite

Security vulnerabilities are among the most pressing problems in open source software package libraries. It may take a long time to discover and fix vulnerabilities in packages. In addition, vulnerabilities may propagate to dependent packages, making them vulnerable too. This paper presents an empirical study of nearly 400 security reports over a 6-year period in the npm dependency network containing over 610k JavaScript packages. Taking into account the severity of vulnerabilities, we analyse how and when these vulnerabilities are discovered and fixed, and to which extent they affect other packages in the packaging ecosystem in presence of dependency constraints. We report our findings and provide guidelines for package maintainers and tool developers to improve the process of dealing with security issues. KEYWORDSsoftware repository mining, software ecosystem, dependency network, security vulnerability, semantic versioning ACM Reference Format: Alexandre Decan, Tom Mens, and Eleni Constantinou. 2018. On the impact of security vulnerabilities in the npm package dependency network. In

show abstract

Section: Security Vulnerabilitiesmentioning

confidence: 99%

On the impact of security vulnerabilities in the npm package dependency network

Decan

Mens

Constantinou

2018

Proceedings of the 15th International Conference on Mining Software Repositories

184

113

View full text Add to dashboard Cite

show abstract

“…Code samples are not frozen projects, but they should be updated over time. Changes are commonly performed to follow recent framework versions, otherwise the code samples become out of date and less attractive to the clients [11], [14]- [17]. Indeed, this practice is often performed by Android and SpringBoot code samples, but much faster in the latter.…”

Section: Discussionmentioning

confidence: 99%

Framework Code Samples: How Are They Maintained and Used by Developers?

Menezes¹,

Cafeo²,

Hora³

2019

2019 ACM/IEEE International Symposium on Empirical Software Engineering and Measurement (ESEM)

View full text Add to dashboard Cite

Background: Modern software systems are commonly built on the top of frameworks. To accelerate the learning process of features provided by frameworks, code samples are made available to assist developers. However, we know little about how code samples are actually developed. Aims: In this paper, we aim to fill this gap by assessing the characteristics of framework code samples. We provide insights on how code samples are maintained and used by developers. Method: We analyze 233 code samples of Android and SpringBoot, and assess aspects related to their source code, evolution, popularity, and client usage. Results: We find that most code samples are small and simple, provide a working environment to the clients, and rely on automated build tools. They change frequently over time, for example, to adapt to new framework versions. We also detect that clients commonly fork the code samples, however, they rarely modify them. Conclusions: We provide a set of lessons learned and implications to creators and clients of code samples to improve maintenance and usage activities. 21 https://github.com/spring-guides 22 https://scitools.com

show abstract

“…Because Maven artifacts are immutable, all the versions of a given library that have been released in Maven Central are always present in the repository. Meanwhile, previous studies have shown that users of a given version do not systematically update their dependency when a new version is released [5], [12], [13]. Consequently, we hypothesize that, at some point in time, multiple versions of a library are actively used.…”

Section: A Research Questionsmentioning

confidence: 93%

“…Library users are free to decide which version to depend on and for how much time. In the long term, these users' decisions determine what are the most popular libraries and versions in the entire software ecosystem [5], [14]. This research question investigates to what extent these decisions lead to the emergence of one or more versions that receive a greater number of usages compared to the other versions.…”

Section: Rq2: How Are the Actively Used Versions Distributed Along Thmentioning

confidence: 99%

See 1 more Smart Citation

The Emergence of Software Diversity in Maven Central

Soto-Valero¹,

Benelallam²,

Harrand³

et al. 2019

2019 IEEE/ACM 16th International Conference on Mining Software Repositories (MSR)

View full text Add to dashboard Cite

Maven artifacts are immutable: an artifact that is uploaded on Maven Central cannot be removed nor modified. The only way for developers to upgrade their library is to release a new version. Consequently, Maven Central accumulates all the versions of all the libraries that are published there, and applications that declare a dependency towards a library can pick any version. In this work, we hypothesize that the immutability of Maven artifacts and the ability to choose any version naturally support the emergence of software diversity within Maven Central. We analyze 1,487,956 artifacts that represent all the versions of 73,653 libraries. We observe that more than 30% of libraries have multiple versions that are actively used by latest artifacts. In the case of popular libraries, more than 50% of their versions are used. We also observe that more than 17% of libraries have several versions that are significantly more used than the other versions. Our results indicate that the immutability of artifacts in Maven Central does support a sustained level of diversity among versions of libraries in the repository.

show abstract

Do developers update their library dependencies?

Cited by 265 publications

References 30 publications

On the impact of security vulnerabilities in the npm package dependency network

On the impact of security vulnerabilities in the npm package dependency network

Framework Code Samples: How Are They Maintained and Used by Developers?

The Emergence of Software Diversity in Maven Central

Contact Info

Product

Resources

About