FlagThis

Abstract

Industry practitioners are increasingly concerned with software that contains vulnerable versions of third-party dependencies that are included both directly and transitively. To address this problem, projects are encouraged to both (a) quickly update to non-vulnerable versions of dependencies and (b) be mindful of the update practices of the dependencies they choose to use. To this end, researchers have proposed metrics to measure the responsiveness of the development teams of the packages in keeping their dependencies updated: Mean-Time-ToUpdate (MTTU) and Mean-Time-To-Remediate (MTTR). While MTTU covers all dependencies, MTTR quantifies the time needed for a package to update its vulnerable dependencies. However, existing metrics fail to capture important nuances, such as considering floating versions and prioritizing recent updates, leading to inaccurate reflections of a development teams update practices. The goal of this study is to aid practitioners in understanding how quickly packages update their dependencies. We propose two novel metrics, Mean-Time-To-Update for dependencies (MTTUdep) and Mean-Time-To-Remediate for vulnerable dependencies (MTTRdep), that overcome the limitations of existing metrics. We conduct an empirical study using 163 , 207 packages in npm ( 117 , 129 ), PyPI ( 42 , 777 ), and Cargo ( 3 , 301 **) and characterize how the ecosystems differ in MTTUdep and MTTRdep, as well as what package characteristics influence MTTUdep and MTTRdep. We found that most packages have a relatively fast dependency update practice. We also found that older packages tend to have higher MTTUdep and MTTRdep values. We further study whether MTTUdep can serve as a proxy for MTTRdep when sufficient vulnerability data are not available. As we did not find sufficient statistical evidence for a strong proxy, our findings suggest that MTTUdep could only be used as a proxy for MTTRdep in practical terms when vulnerability data is not available. This latter finding is particularly important given that only 1363 npm (0.04%), 694 PyPI (0.11%), and 383 Cargo (0.20%) packages have reported vulnerabilities, and the existence of MTTUdep will allow practitioners to make more informed decisions about the dependencies they choose.