A deep dive into measuring dependency freshness with lib year
1 like238 views
Scott Ford discusses measuring and improving dependency freshness in software projects. He introduces LibYear, a metric that quantifies how out of date a project's dependencies are by calculating the number of years between the latest and current version of each dependency. Automated tools like Freshli and PySpider can compute LibYear over time to identify trends and prioritize which outdated dependencies to upgrade first. Regularly upgrading dependencies improves developer productivity, reduces security risks, and maintains customer trust.
A deep dive into measuring dependency freshness with lib year
- 1. @mscottford MEASURING DEPENDENCY FRESHNESS BY M. SCOTT FORD CO-FOUNDER & CHIEF CODE WHISPERER, CORGIBYTES A DEEP DIVE INTO USING LIBYEAR
- 4. @mscottford HI. I LOVE TO FIX BUGS. I’M SCOTT.
- 7. @mscottford WHY DOES THIS HAPPEN? Photo credit: https://www.flickr.com/photos/mharrsch/402046838
- 8. @mscottford WHY DOES THIS HAPPEN? • Fear Photo credit: https://www.flickr.com/photos/mharrsch/402046838
- 9. @mscottford WHY DOES THIS HAPPEN? • Fear • Time Photo credit: https://www.flickr.com/photos/mharrsch/402046838
- 10. @mscottford WHY DOES THIS HAPPEN? • Fear • Time • Priorities Photo credit: https://www.flickr.com/photos/mharrsch/402046838
- 11. @mscottford WHY DOES THIS HAPPEN? • Fear • Time • Priorities • Perceived difficulty Photo credit: https://www.flickr.com/photos/mharrsch/402046838
- 12. @mscottford WHY DOES THIS HAPPEN? • Fear • Time • Priorities • Perceived difficulty • Invisible problem Photo credit: https://www.flickr.com/photos/mharrsch/402046838
- 13. @mscottford DEPENDENCY FRESHNESS Source: Measuring Dependency Freshness in Software Systems by J. Cox et al. (ICSE 2015), May 2015 https://ericbouwers.github.io/papers/icse15.pdf @mscottford
- 14. @mscottford IT’S LIKE BRUSHING YOUR TEETH @mscottford
- 16. @mscottford BRUSH YOUR TEETH Source: Measuring Dependency Freshness in Software Systems by J. Cox et al. (ICSE 2015), May 2015 https://ericbouwers.github.io/papers/icse15.pdf @mscottford OUT OF DATE DEPENDENCIES HAVE CONSEQUENCES @mscottford
- 18. @mscottford • Difficult to work with FOR DEVS @mscottford
- 19. @mscottford • Difficult to work with • Docs are hard to find FOR DEVS @mscottford
- 20. @mscottford • Difficult to work with • Docs are hard to find • Support is lacking FOR DEVS @mscottford
- 22. @mscottford FOR ORGS • Developer productivity
- 23. @mscottford FOR ORGS • Developer productivity • Significant security risks
- 24. @mscottford FOR ORGS • Developer productivity • Significant security risks • PR fallouts or loss of customer trust
- 28. @mscottford WHY LIBYEAR? • Easy to compute
- 29. @mscottford WHY LIBYEAR? • Easy to compute • Distills dependency risk as a single number
- 30. @mscottford WHY LIBYEAR? • Easy to compute • Distills dependency risk as a single number • Easy to communicate
- 31. @mscottford WHY LIBYEAR? • Easy to compute • Distills dependency risk as a single number • Easy to communicate • Provides even more value when graphed over time
- 33. @mscottford LATEST VERSION: RELEASE DATE CURRENT VERSION: RELEASE DATE – = PACKAGE LIBYEAR LIBYEAR: SINGLE PACKAGE @mscottford
- 34. @mscottford PACKAGE(0).LIBYEAR + PACKAGE(1).LIBYEAR + PACKAGE(N).LIBYEAR … = PROJECT LIBYEAR LIBYEAR: ENTIRE PROJECT @mscottford
- 38. @mscottford
- 39. @mscottford HOW TO MEASURE AUTOMATED – CHANGES OVER TIME
- 42. @mscottford
- 43. @mscottford
- 45. @mscottford
- 46. @mscottford
- 47. @mscottford FRESHLI’S FUTURE MISSION VISION Create tools that clearly illustrate the financial risk of deferred software maintenance. Software systems are self-healing and outdated dependencies are a thing of the past.
- 48. @mscottford BEST NEXT STEPS • Develop metric that considers security risk • Formulate ways to better compare LibYear across projects • Provide more guidance about “good” values (apps <= 10)
- 49. @mscottford GET INVOLVED • github.com/corgibytes/freshli • Add more metrics • Support more ecosystems and dependency formats • Improve graph quality
- 52. @mscottford CONTACT INFO M. SCOTT FORD scott@corgibytes.com @mscottford in/mscottford 804-596-2375 x701