Do Developers Update Their Library Dependencies?
An Empirical Study on the Impact of Security Advisories on Library Migration
1,231,41,22Raula Gaikovina Kula , Daniel M. German , Ali Ouni , Takashi Ishio , Katsuro Inoue
1234Nara Institute of Science & Technology , Osaka University , University of Victoria , UAE University

Research Questions
I Tracking Library Migration in Practice. RQ1: To what extent are developers updating their library dependencies?
I Developer Responsiveness to Awareness Mechanisms. RQ2: What is the response to important awareness mechanisms such as anew release announcement and a security advisory on library updates?
. RQ3: Why are developers non responsive to a security advisory?
Library Migration & Awareness Mechanisms
I Tracking System & Libraries: We define a model of system and librarydependency relations. Hence, we formally use the following notations. We
define S for a system, and L for a library. L(lib,v) denotes version v of alibrary lib, and S(sys,w) for version w of a system sys.
Peak LU
Point y in time

Library A5

Library Residue

LU

System B

Library C2100

5070

Studied Libraries(a) Systems heavily(b) There is little

rely on third-party
dependencies

correlation between
frequent updates
and # dependencies

60 10020

Library Residue (%)

80
60
20030
# DUs

Studied Systems

Figure: Heartbleed, Poodle, Shellshock,–all high profile library vulnerabilities were
found to have affected a significant
portion of the software industry.

40

Library Residue(%)

2500
1500
500

# Library Dependencies

2500
1500

0 10

The goal of our study is to investigate (1) whether or not dependencies arebeing updated and (2) the level of developer awareness to dependency
migration opportunities such as fixing security vulnerabilities.

Point x in time

500

I In 2014, Sonatype determinedthat over 6% of the download
requests from the MavenCentral repository included
known vulnerabilities.

0Many software projects today advocate the use of third-party libraries
because of its many benefits: Our motivation stems from reports ofoutdated and vulnerable libraries being widespread in the software industry.

# Library Dependencies

RQ1: Library Migration

Motivation

0200

400600800

Peak LU(a) Library(b) Systems are more likely to

migration is notcommon practicefor older versions

remain with older popularlibrary versions

Figure: Library Analysis

Figure: System Analysis

I Approach: We analyze 4,659 GitHub Projects and 2,700 librarydependencies to understand the extent to which (i) systems use andmanage their library dependencies and (ii) library usage trends.
I Results: We find that (i) although system heavily depend on libraries,
most systems rarely update their libraries and (ii) systems are less likely
migrate their library dependencies, with 81.5% of systems remaining with apopular older version.
RQ2: Awareness Mechanisms (Security Advisories)
Table: Eight Case Studies
Libraries Studied
New Releases
google-guava,junit, log4j
Security Vulnerabilites commons-beautils, commons-fileupload, commons-httpclient
httpcomponents commons-compress

I Approach: Using the LMP, we conducted a case study of eight update
opportunities (i.e., 3 new releases and 5 security vulnerabilities) tounderstand developer responsiveness to (i) a new release and (ii) a security
advisory disclosure.
I Results: For a new release of a popular library (i) there exist patterns ofconsistent migration and patterns where an older popular library version isstill preferred. For a security advisory disclosure we find cases of developer(ii) non responsiveness to security advisory disclosure, which is sometimes
due to an incomplete patch or a latent security advisory.

Current LU

RQ3: Developer Survey

System Dt0

Figure: Library migration between systems
and libraries. The orange arrow depicts
dependency relations between them.

Pre‐Peakt1

Post‐PeakTimet2

Figure: Simple example of the LU-based
metrics. We show the Peak LU at time t1,current LU at time t2 and library residue(Peak LU / Current LU).

peak LU

Library affected version
current LU versions
CVE‐2014‐0114

2010Conclusions

commons-beanutils 1.9.1

Java 5+commons-beanutils 1.9.2

Java 5+

2016-01

2015-072015-01

2014-01

2014-07

Java Environment

0April 2014

LUby Systems
Library Usage

I Effectiveness of Awareness Mechanisms: We propose a Library
Migration Plot (LMP) to visualize impact of awareness mechanisms such asa security advisory.

I Approach: In a follow-up, we surveyed 16 projects affected by the 5vulnerabilities in RQ2, to understand developer awareness and opinions
regarding the practice of dependency updates.
I Results: We find that 69% of developers were unaware of their vulnerable
dependencies and proceeded to immediately migrate to a safer dependency.
Developers evaluate the decision whether or not to update its dependencies
based on project specific priorities. Developers cite migration as a practicethat requires extra migration effort and added responsibility.

Time tFigure: A Library Migration Plot for libraries L(beanutils,1.9.1) and L(beanutils,1.9.2).
In this example, the release of a related security advisory CVE-2014-0114 (black dashed line)that affects L(beanutils,1.9.1) (marked with crossbones). We also show which JDK (5+)
version in which the version supports.

Although third-party library dependencies is widely practiced, we find that
updating is not:I The study provides motivation for our community develop strategies toimprove a developer personal perception of third-party updates.
I Visual aids such as the Library Migration Plots (LMP) could prove usefulawareness and motivation for developers quickly update.
I Future work include understanding how developers perceive migration effort
and understand responsibilities when using a third-party library dependency.
Replication Dataset
Table: Collected dataset

Acknowledgments
I This work is supported by JSPS KANENHI (Grant Numbers JP25220003
and JP26280021) and the “Osaka University Program for Promoting
International Joint Research.”

Nara Institute of Science and Technology, JapanWe make available our dataset of 852,322
library dependency migrations at

projects creation dates
2004-Oct to 2009-Jan
projects last update
2015-Jan to 2015-Nov# unique systems (projects)
48,495 (4,659)# unique library versions
2,736
total size of projects
630 GB# commits related to pom.xml
4,892,770# library dependency migrations
852,322https://raux.github.io/
Impact-of-Security-Advisories-on-Library-Migrations/.

ESEC/FSE17-J1 Paper (EMSE Journal)