Back to the Past – Analysing Backporting Practices in Package Dependency Networks

Alexandre Decan, Tom Mens, Ahmed Zerouali, Coen De Roover

Onderzoeksoutput: Articlepeer review

3 Citaten (Scopus)


The practice of backporting aims to bring the benefits of a bug or vulnerability fix from a higher to a lower release of a software package. When such a package adheres to semantic versioning, backports can be recognised as new releases in a lower major train. This is particularly useful in case a substantial number of software packages continues to depend on that lower major train. In this article, we study the backporting practices in four popular package distributions, namely Cargo, npm, Packagist and RubyGems. We observe that many dependent packages could benefit from backports provided by their dependencies. In particular, we find that a majority of security vulnerabilities affect more than one major train but are only fixed in the highest one, letting thousands of dependent packages exposed to the vulnerability. Despite that, we find that backporting updates is quite infrequent, and mostly practised by long-lived and more active packages for a variety of reasons.
Originele taal-2English
Pagina's (van-tot)4087-4099
Aantal pagina's13
TijdschriftIEEE Transactions on Software Engineering
Nummer van het tijdschrift10
StatusPublished - 16 sep 2021

Bibliografische nota

Publisher Copyright:
© 1976-2012 IEEE.

Copyright 2022 Elsevier B.V., All rights reserved.


Duik in de onderzoeksthema's van 'Back to the Past – Analysing Backporting Practices in Package Dependency Networks'. Samen vormen ze een unieke vingerafdruk.

Citeer dit