Analysing the Relationship Between Dependency Definition and Updating Practice When Using Third-Party Libraries

Abstract

Using third-party libraries is common practice when developing software. Package managers have made it easy to add third-party libraries as dependencies and to keep dependency versions up to date. Nevertheless, research shows that developers are prone to not updating their dependencies. We study how the type of version requirements used in the package manager manifest files affect dependency updating lag time (measured in days) and how this lag affects dependencies to vulnerable library versions. We focus on the package managers commonly used in iOS development, i.e., CocoaPods, Carthage and Swift PM. We first measure how the dependency updating lag time evolves over time for each package manager. Then we analyze whether and how the chosen type of version requirement affects the dependency updating lag time. Third, we investigate how not re-running package manager version resolution affects library updates. Lastly, we analyse how many vulnerable dependencies could have been fixed by updating the dependency. We found that dependency updating lag time differs between package managers but grows over time for all of them. We also found that the preferred version requirement types differ between package managers. As expected, version requirement types that are less restrictive produce less dependency updating lag. Moreover, we found that keeping library dependency versions up to date results in less vulnerable dependencies. Interestingly, some of the vulnerable dependencies could have been fixed by simply rerunning the package manager version resolution.