Technical Lag of Dependencies in Major Package Managers
Jacob Stringer, Amjed Tahir, Kelly Blincoe, Jens Dietrich
Abstract
Background: Third party libraries used by a project (dependencies) can easily become outdated over time, a phenomenon called technical lag. Keeping dependencies up to date induces a significant overhead in terms of the resources (e.g, developer time), but necessary to maintain software quality. Aims: This study provides a large scale analysis of technical lag across the major package managers currently in use. Method: We conducted a mixed-methods study using open-source project data obtained from 14 package managers using the libraries.io dataset. Results: The majority of fixed version declarations, along with a significant number of flexible declarations, are outdated. Fixed declarations are not regularly updated, except in major updates, so they quickly lag. Despite the prevalence of breaking changes in updates, downgrading declarations to earlier versions are rare. Conclusions: Technical lag is prevalent but preventable across package managers - semantic versioning based declaration ranges would remove the majority of lag. Further tooling uptake is also recommended to minimise technical lag.