Back to the Past – Analysing Backporting Practices in Package Dependency Networks

Alexandre Decan, Tom Mens, Ahmed Zerouali, Coen De Roover

Research output: Contribution to journalArticlepeer-review


The practice of backporting aims to bring the benefits of a bug or vulnerability fix from a higher to a lower release of a software package. When such a package adheres to semantic versioning, backports can be recognised as new releases in a lower major train. This is particularly useful in case a substantial number of software packages continues to depend on that lower major train. In this article, we study the backporting practices in four popular package distributions, namely Cargo, npm, Packagist and RubyGems. We observe that many dependent packages could benefit from backports provided by their dependencies. In particular, we find that a majority of security vulnerabilities affect more than one major train but are only fixed in the highest one, letting thousands of dependent packages exposed to the vulnerability. Despite that, we find that backporting updates is quite infrequent, and mostly practised by long-lived and more active packages for a variety of reasons.
Original languageEnglish
Pages (from-to)4087-4099
Number of pages13
JournalIEEE Transactions on Software Engineering
Issue number10
Publication statusPublished - 16 Sep 2021

Bibliographical note

Publisher Copyright:
© 1976-2012 IEEE.

Copyright 2022 Elsevier B.V., All rights reserved.


Dive into the research topics of 'Back to the Past – Analysing Backporting Practices in Package Dependency Networks'. Together they form a unique fingerprint.

Cite this