1,721,947 research outputs found
Dependabot usage impact on project dependency freshness.
No full textIn order to maintain up-to-date dependency versions, oftentimes the automatic dependency update tool Dependabot is used. However, due to various reasons, the pull requests it creates in GitHub are frequently ignored. To evaluate the tool's impact on dependency freshness - a metric indicating how outdated a project's dependencies are - the libyear calendar day difference calculation method is used. This study analyzes .NET projects from the GitHub system and evaluates the freshness (or age) of their dependencies. In order to ensure objective assessment, two project groups were formed: one using Dependabot, and another not using Dependabot (or any other popular automated dependency tool). These groups were normalized into similar project groups based on project activity and dependency count. The results show that projects that use Dependabot experience approximately 25% fresher dependencies compared to projects that do not use Dependabot. Additionally, from July 2023 to April 2025, the overall dependency age in projects that use Dependabot decreased by approximately 64.5-66.6%, while projects that do not use Dependabot experienced about a 49.3-57.4% decrease in dependency age. The use of Dependabot is associated with a stronger decline in dependency age over time
On the Effectiveness of Dependabot Security Pull Requests
No full textThis dataset contains the data files used to analyze our RQs in the manuscript "On the Effectiveness of Dependabot Security Pull Requests."
For more information on how to understand the folder structure and dataset, please read the README.md
On the Use of Dependabot Security Pull Requests
No full textThis dataset contains the data files used to analyze our RQs in the manuscript "On the Use of Dependabot Security Pull Requests."
For more information on how to understand the folder structure and dataset, please read the README.md
Investigating the Resolution of Vulnerable Dependencies with Dependabot Security Updates
Get PDFModern software development practices increasingly rely on third-party libraries due to the inherent benefits of reuse. However, libraries may contain security vulnerabilities that can propagate to the dependent applications. To counter this, maintainers of dependent projects should monitor their dependencies and security reports to ensure that only patched releases of the upstream applications are in use. As manual maintenance of dependencies has shown to be ineffective, several automated tools (aka bots) have been proposed to assist developers in rapidly identifying and resolving vulnerable dependencies. In this work, we focus on Dependabot, a popular bot providing security and version updates, and study developers' receptivity to its security updates in engineered and actively maintained JavaScript projects. Moreover, we carry out a fine-grained analysis of the lifecycle of every vulnerability to manifest how they are dealt with in the presence of Dependabot. Our findings show that the task of fixing vulnerable dependencies is, to a large extent, delegated to Dependabot and that developers merge the majority of security updates within several days. On the other hand, when developers do not merge a security update, they usually address the identified vulnerability manually. This approach, however, often takes up to several months which in turn could expose the projects to security issues
Evolving Trends in the Adoption and Effectiveness of DEPENDABOT Security Pull Requests
No full textIn the rapidly evolving software industry, bots have become integral to automating tasks and enhancing developer productivity and are revolutionizing the way security patches are implemented in software projects. Our study investigates the impact of DEPENDABOT on the speed and efficacy of security patching in GitHub Open Source Software projects, by studying merge times and factors that contribute to DEPENDABOT’s resolution of security issues in JavaScript projects. We use a dataset containing DEPENDABOT Security Pull Requests. Our study validates previous findings by collecting data from the GitHub API and publishing a dataset collected between 2021 and 2024. We face challenges with collecting features impacting merge times, but overcome them by prioritizing the top 3 features and 2 additional ones. We also investigate the factors behind not merging Pull Requests to identify the obstacles in adopting DEPENDABOT’s recommendations, by analysing Pull Request comments. We start performing sentiment analysis and topic modeling but switch to GitHub Copilot instead and continue investigating presence of factors impacting rapid merge times. Our results present a lower adoption rate of DEPENDABOT Security Pull Requests in JavaScript Open Source Software projects, specifically 13%, compared to those of the original study. 76% of Pull Requests are merged within 4 days, with a median decision time of 0,3 days. The main reason for not merging a DEPENDABOT Security Pull Requests is that another DEPENDABOT Security Pull Request supersedes it. Factors associated with faster merge are related to smaller changes and, controversially, disabling auto merge
Evolving Trends in the Adoption and Effectiveness of DEPENDABOT Security Pull Requests
No full textIn the rapidly evolving software industry, bots have become integral to automating tasks and enhancing developer productivity and are revolutionizing the way security patches are implemented in software projects. Our study investigates the impact of DEPENDABOT on the speed and efficacy of security patching in GitHub Open Source Software projects, by studying merge times and factors that contribute to DEPENDABOT’s resolution of security issues in JavaScript projects. We use a dataset containing DEPENDABOT Security Pull Requests. Our study validates previous findings by collecting data from the GitHub API and publishing a dataset collected between 2021 and 2024. We face challenges with collecting features impacting merge times, but overcome them by prioritizing the top 3 features and 2 additional ones. We also investigate the factors behind not merging Pull Requests to identify the obstacles in adopting DEPENDABOT’s recommendations, by analysing Pull Request comments. We start performing sentiment analysis and topic modeling but switch to GitHub Copilot instead and continue investigating presence of factors impacting rapid merge times. Our results present a lower adoption rate of DEPENDABOT Security Pull Requests in JavaScript Open Source Software projects, specifically 13%, compared to those of the original study. 76% of Pull Requests are merged within 4 days, with a median decision time of 0,3 days. The main reason for not merging a DEPENDABOT Security Pull Requests is that another DEPENDABOT Security Pull Request supersedes it. Factors associated with faster merge are related to smaller changes and, controversially, disabling auto merge
Going Beyond Counting First Authors in Author Co-citation Analysis
Get PDFThe present study examines one of the fundamental aspects of author co-citation analysis (ACA) - the way co-citation
counts are defined. Co-citation counting provides the data on which all subsequent statistical analyses and mappings
are based, and we compare ACA results based on two different types of co-citation counting - the traditional type that
only counts the first one among a cited work's authors on the one hand and a non-traditional type that takes into
account the first 5 authors of a cited work on the other hand. Results indicate that the picture produced through this non-traditional author co-citation counting contains more coherent author groups and is therefore considerably clearer. However, this picture represents fewer specialties in the research field being studied than that produced through the traditional first-author co-citation counting when the same number of top-ranked authors is selected and analyzed. Reasons for these effects are discussed
Variations on the Author
Get PDF“Variations on the Author” discusses two of Eduardo Coutinho’s recent films (Um Dia na Vida, from 2010, and Últimas Conversas, posthumously released in 2015) and their contribution to the general question of documentary authorship. The director’s filmography is characterized by a consistent yet self-effacing form of authorial self-inscription: Coutinho often features as an interviewer that rather than express opinions propels discourses; an interviewer that is good at listening. This mode of self-inscription characterizes him as an author who is not expressive but who is nonetheless markedly present on the screen. In Um Dia na Vida, however, Coutinho is completely absent form the image, while Últimas Conversas, on the contrary, includes a confessional prologue that moves the director from the margins to the center of his films. This article examines the ways in which these works stand out in the filmography of a director who offers new insights into the notion of cinematic authorship
Leveraging the Crowd for Dependency Management: An Empirical Study on the Dependabot Compatibility Score
Get PDFDependabot, a popular dependency management tool, includes a compatibility
score feature that helps client packages assess the risk of accepting a
dependency update by leveraging knowledge from "the crowd". For each dependency
update, Dependabot calculates this compatibility score as the proportion of
successful updates performed by other client packages that use the same
provider package as a dependency. In this paper, we study the efficacy of the
compatibility score to help client packages assess the risks involved with
accepting a dependency update. We analyze 579,206 pull requests opened by
Dependabot to update a dependency, along with 618,045 compatibility score
records calculated by Dependabot. We find that a compatibility score cannot be
calculated for 83% of the dependency updates due to the lack of data from the
crowd. Yet, the vast majority of the scores that can be calculated have a small
confidence interval and are based on low-quality data, suggesting that client
packages should have additional angles to evaluate the risk of an update and
the trustworthiness of the compatibility score. To overcome these limitations,
we propose metrics that amplify the input from the crowd and demonstrate the
ability of those metrics to predict the acceptance of a successful update by
client packages. We also demonstrate that historical update metrics from client
packages can be used to provide a more personalized compatibility score. Based
on our findings, we argue that, when leveraging the crowd, dependency
management bots should include a confidence interval to help calibrate the
trust clients can place in the compatibility score, and consider the quality of
tests that exercise candidate updates
- …
