On the evolution of technical lag in the npm package dependency network
0 likes109 views
The document discusses the phenomenon of technical lag in the npm package dependency network, highlighting that 25% of dependencies and 40% of releases are affected by it, with an average lag of 7 to 9 months. It emphasizes the importance of semantic versioning and effective dependency management tools in reducing technical lag. The authors conclude that proper monitoring and management of dependencies can help package maintainers mitigate issues associated with outdated packages.
![Technical Lag
[1] J. M. Gonzalez-Barahona et al. Technical lag in software compilations: Measuring how outdated a software deployment is. IFIP International
Conf. on Open Source Systems, pp. 182—192, 2017.
How outdated a
software system is with
respect to its upstream
dependencies [1]](https://image.slidesharecdn.com/icsme2018-decanconstantinoumens-180928122527/85/On-the-evolution-of-technical-lag-in-the-npm-package-dependency-network-6-320.jpg)
![NOVEMBER 2017
Libraries.io [2]
[2] http://doi.org/10.5281/zenodo.1068916](https://image.slidesharecdn.com/icsme2018-decanconstantinoumens-180928122527/85/On-the-evolution-of-technical-lag-in-the-npm-package-dependency-network-11-320.jpg)
On the evolution of technical lag in the npm package dependency network
- 1. ICSME 2018 ON THE EVOLUTION OF TECHNICAL LAG IN THE NPM PACKAGE DEPENDENCY NETWORK ALEXANDRE DECAN ELENI CONSTANTINOU TOM MENS @AlexandreDecan @tom_mens @eleni_const
- 4. Semantic versioning major minor patch 3 9 2 Breaking changes Bug fixes Backwards compatible changes 4.0.0 3.10.0 3.9.3
- 6. Technical Lag [1] J. M. Gonzalez-Barahona et al. Technical lag in software compilations: Measuring how outdated a software deployment is. IFIP International Conf. on Open Source Systems, pp. 182—192, 2017. How outdated a software system is with respect to its upstream dependencies [1]
- 7. Δt(d3,t) Δt(d2,t) Δt(d1,t) r p1 p2 p3 Technical lag at time t For a dependency d: For a release r:
- 8. T1 p1 p2 1.0.0 1.0.1 1.0.21.1.0 r1 r2 T2 T3 T4 T5 T6 T7 T9T8 2.0.0 T10 Technical lag example 1.0.0 1.0.0Analysis date Constraint Missed Technical Lag ~1.0.0 {1.1.0, 2.0.0} ^1.0.0 {2.0.0} T10 – T5 T10 – T9 p2p1
- 9. Should I keep my dependencies up-to-date? COST § Effort to integrate backwards incompatible changes § Monitor dependency evolution RISK § Backwards incompatible changes BENEFIT § Bug fixes § Security vulnerability fixes § New features
- 10. DATASET
- 11. NOVEMBER 2017 Libraries.io [2] [2] http://doi.org/10.5281/zenodo.1068916
- 12. FINDINGS
- 13. How prominent is technical lag (TL)? 25% of dependencies/ 40% of releases suffer from TL Dependency management tools reduce TL presence
- 14. How long is the technical lag? >=2015: average TL is 7 to 9 months Only 25% have a TL <52 days TL information in dependency management tools
- 15. How frequently are packages updated? It takes an average of 12 to 22 days to update a release Frequent updates can contribute to TL of dependents
- 16. During the lifetime of a package release, a new release of its dependency becomes available that does not satisfy the dependency constraint Why does technical lag occur? A package release does not use the highest available release of its dependency 1 out of 3 releases missed a new release of a dependency because it is excluded by the constraint.
- 17. How does technical lag evolve? Most packages do not change their constraints to use newer releases of their dependencies. Better tool support for managing constraints
- 18. Could technical lag be reduced by proper use of semantic versioning? The proportion of releases suffering from TL could be reduced by 17.7% Package maintainers should adhere to semantic versioning
- 20. npm package releases/dependencies suffer from technical lag 7 - 9 months of technical lag Proper use of semantic versioning Ø Decreases the effect of technical lag (~18%) Ø Allows to benefit from vulnerability fixes Summary
- 21. Conclusion Dependency management tools help package maintainers to reduce the presence technical lag. Dependency monitoring tools should incorporate technical lag information. Ecosystem-wide view of technical lag. Support dependent packages/backport important fixes. Transitive dependencies Direct dependencies Technical lag definition