DI-UMONS : Dépôt institutionnel de l’université de Mons

Recherche transversale
(titres de publication, de périodique et noms de colloque inclus)
2021-09-27 - Article/Dans un journal avec peer-review - Anglais - 14 page(s)

Decan Alexandre , Mens Tom , Zerouali Ahmed, De Roover Coen, "Back to the Past - Analysing Backporting Practices in Package Dependency Networks" in IEEE Transactions on Software Engineering, 10.1109/TSE.2021.3112204

  • Edition : Institute of Electrical and Electronics Engineers, New-York (NY)
  • Codes CREF : Informatique appliquée logiciel (DI2570), Informatique générale (DI1162), Analyse de systèmes informatiques (DI2572)
  • Unités de recherche UMONS : Génie Logiciel (S852)
  • Instituts UMONS : Institut de Recherche en Technologies de l’Information et Sciences de l’Informatique (InforTech), Institut de Recherche sur les Systèmes Complexes (Complexys)
Texte intégral :

Abstract(s) :

(Anglais) The practice of backporting aims to bring the benefits of a bug or vulnerability fix from a higher to a lower release of a software package. When such a package adheres to semantic versioning, backports can be recognised as new releases in a lower major train. This is particularly useful in case a substantial number of software packages continues to depend on that lower major train. In this article, we study the backporting practices in four popular package distributions, namely Cargo, npm, Packagist and RubyGems. We observe that many dependent packages could benefit from backports provided by their dependencies. In particular, we find that a majority of security vulnerabilities affect more than one major train but are only fixed in the highest one, letting thousands of dependent packages exposed to the vulnerability. Despite that, we find that backporting updates is quite infrequent, and mostly practised by long-lived and more active packages for a variety of reasons.

Identifiants :
  • DOI : 10.1109/TSE.2021.3112204