On Backporting Practices in Package Dependency Networks
summary
Examines backporting behavior in four package ecosystems—Cargo, npm, Packagist and RubyGems—by measuring how often fixes (especially security fixes) are released into older major versions that many dependents still use. Reports that most vulnerabilities span multiple major trains but fixes are usually applied only to the newest train, leaving many dependents exposed, and finds backporting is rare and mainly done by long-lived, active packages.
AI-written summary · about
related talks
27mDependency hell - Or, Developers' perception of software dependencies
36mThe Role of Package Managers as Partners in License and Attribution Compliance
39mTrials and Tribulations of Updating Dependencies for Vulnerability...
45mNext Gen Package Management
25mThe node_modules Iceberg: Mysteries Below the Waterline
42mSponsored Session: Dependencies: Do's and Don'ts
38mDependency Management: The Cause of—and Solution to—All Supply...
24mManaging Dependencies with Confidence