Characterizing Dependency Update Practice of NPM, PyPI, and Cargo Packages
Published in arxiv, 2024
We propose two dependency update metrics: Time-Out-Of-Date (TOOD) and Post-Fix-Exposure-Time (PFET), to measure the updatedness of dependencies and updatedness of vulnerable dependencies, respectively. We did a large-scale study of our proposed update metrics in NPM, PyPI, and Cargo packages.
Recommended citation: @article{rahman2024characterizing, title={Characterizing Dependency Update Practice of NPM, PyPI and Cargo Packages}, author={Rahman, Imranur and Zahan, Nusrat and Magill, Stephen and Enck, William and Williams, Laurie}, journal={arXiv preprint arXiv:2403.17382}, year={2024} }
Download Paper