Lessons from the Long Tail: Analysing Unsafe Dependency Updates across Software Ecosystems

TL;DR

This paper analyzes unsafe dependency updates across software ecosystems, revealing that risks are widespread beyond just critical libraries and proposing a research agenda to improve safety practices ecosystem-wide.

Contribution

It provides empirical data on unsafe dependency updates in the long tail of libraries and introduces a research agenda to enhance dependency safety practices across the entire ecosystem.

Findings

Unsafe dependency updates are common beyond high-impact libraries.

Preliminary data from 88,416 pull requests highlights ecosystem-wide risks.

Proposes a research agenda with six key questions for safer dependency management.

Abstract

A risk in adopting third-party dependencies into an application is their potential to serve as a doorway for malicious code to be injected (most often unknowingly). While many initiatives from both industry and research communities focus on the most critical dependencies (i.e., those most depended upon within the ecosystem), little is known about whether the rest of the ecosystem suffers the same fate. Our vision is to promote and establish safer practises throughout the ecosystem. To motivate our vision, in this paper, we present preliminary data based on three representative samples from a population of 88,416 pull requests (PRs) and identify unsafe dependency updates (i.e., any pull request that risks being unsafe during runtime), which clearly shows that unsafe dependency updates are not limited to highly impactful libraries. To draw attention to the long tail, we propose a research agenda comprising six key research questions that further explore how to safeguard against these unsafe activities. This includes developing best practises to address unsafe dependency updates not only in top-tier libraries but throughout the entire ecosystem.