Back to the Past – Analysing Backporting Practices in Package Dependency Networks

Alexandre Decan, Tom Mens, Ahmed Zerouali, Coen De Roover

Research output: Contribution to journalArticle

Abstract

The practice of backporting aims to bring the benefits of a bug or vulnerability fix from a higher to a lower release of a software package. When such a package adheres to semantic versioning, backports can be recognised as new releases in a lower major train. This is particularly useful in case a substantial number of software packages continues to depend on that lower major train. In this article, we study the backporting practices in four popular package distributions, namely Cargo, npm, Packagist and RubyGems. We observe that many dependent packages could benefit from backports provided by their dependencies. In particular, we find that a majority of security vulnerabilities affect more than one major train but are only fixed in the highest one, letting thousands of dependent packages exposed to the vulnerability. Despite that, we find that backporting updates is quite infrequent, and mostly practised by long-lived and more active packages for a variety of reasons.
Original languageEnglish
Number of pages14
JournalIEEE Transactions on Software Engineering
Volume2021
DOIs
Publication statusPublished - 16 Sep 2021

Fingerprint

Dive into the research topics of 'Back to the Past – Analysing Backporting Practices in Package Dependency Networks'. Together they form a unique fingerprint.

Cite this