Modern software systems rely heavily on open-source dependencies, yet maintaining these dependencies remains challenging due to the conflicting requirements of freshness, compatibility, and security. Existing tools provide only partial support and often rely on client-specific information, which does not generalize or scale to efficiently manage dependency sets across diverse clients. As a result, developers remain largely responsible for ensuring the quality of their dependency sets. This PhD project investigates how dependency managers can be empowered to provide dependency sets that are up-to-date, compatible, and secure. I hypothesize that this requires fine-grained and reusable knowledge about how dependencies evolve and interact, which is not currently available or exploited by existing resolvers. To address this, I propose a data-driven dependency management approach that aggregates detailed compatibility and security information and incorporates it into fine-grained, optimizable resolution constraints. The project will contribute techniques for client-agnostic compatibility analysis, a dataset of fine-grained library changes, a hybrid client-aware compatibility and vulnerability detection approach, and an optimization-based dependency resolver tailored to client usage. Together, these contributions aim to reduce the developer burden of dependency maintenance and strengthen the software supply chain.

@inproceedings{paperbot11825,
  title = {Shifting the Maintenance Burden: Towards Data-Driven Dependency Management},
  author = {Cathrine Paulsen},
  booktitle = {ICSE},
  year = {2026},
  doi = {10.1145/3774748.3787678}
}