一句话：首次大规模实证刻画 Java/Maven 中隐式依赖的成因、生命周期影响与安全维护后果。
论文首次以隐式依赖为核心对象，研究 Java/Maven 生态中未声明却被项目直接使用的依赖。作者从 Maven Central 和 GitHub 构建大规模数据集，涵盖 1,157 个库、19,812 个版本和 972 个模块，量化隐式依赖的存在、成因、生命周期后果及安全维护风险。结果显示，34.12% 的样本含隐式依赖，主要归因于两类原因；其中 48% 因版本漂移引入破坏性变更，36 个 CVE 的脆弱方法被根项目直接使用，30.28% 的隐式依赖在 SCA 工具对声明依赖所用版本范围约定下受已知漏洞影响。最后总结四类应对措施，为开源生态参与者提供可操作建议。
As software usage continues to expand, package managers automatically resolve dependencies to construct a dependency graph based on user-specified requirements. These explicitly declared dependencies, known as direct dependencies, receive significant attention in terms of maintainability and security. However, implicit dependencies, which are not explicitly defined by users but are still directly utilized or referenced in their project code due to oversight, remain largely unnoticed. Unlike ordinary transitive dependencies, which may remain unused and invisible to the root, implicit dependencies are actively used yet undeclared, leaving their versions outside the project’s direct control. This lack of awareness poses substantial challenges related to security and maintainability. In this study, we present the first study to treat implicit dependencies as the focal phenomenon and quantitatively characterize their lifecycle consequences for the Maven ecosystem. We meticulously collected and built a large-scale dataset with 1,157 libraries with 19,812 versions from the Maven Central Repository and 972 modules from GitHub. Our findings reveal that 34.12% of the analyzed dataset contains implicit dependencies, with two primary causes identified as key contributors to the issue. Among these, 48% introduce breaking changes due to version drift, and 36 CVEs have vulnerable methods directly used by root projects; 30.28% of implicit dependencies are affected by known vulnerabilities under the version-range convention SCA tools use for declared dependencies. Finally, we identified and analyzed four major countermeasures, providing actionable insights and practical implications for addressing this overlooked issue for stakeholders within the OSS ecosystem.
@inproceedings{paperbot12398,
title = {Implicit, Yet Impactful: Understanding Hidden Dependencies in Java Projects},
author = {Lyuye Zhang and Chengwei Liu and Fangyuan Zhang and Yiran Zhang and Yuan Zhou and Yang Liu},
booktitle = {ASE},
year = {2026},
doi = {10.1145/3832783.3837552}
}