一句话：用生存分析在 npm、PyPI、Cargo 生态实证比较固定与浮动版本约束对依赖过时及易受攻击可能性的影响。
依赖版本约束的选择在固定（pinning）与浮动（floating）之间存在权衡：固定可降低破坏性变更与供应链攻击风险，却需人工管理替换，易导致依赖过时；浮动可自动获取缺陷与安全修复，却可能引入不兼容变更。论文针对 npm、PyPI 与 Cargo 三个生态，首先刻画开发者使用版本约束的趋势以及约束类型间迁移的模式，随后用生存分析对依赖状态转移建模，估计固定相较其他约束类型时依赖变为过时或易受攻击的可能性。结果显示，在过时与易受攻击的依赖中，floating-minor 最常见，pinning 次之；floating-major 最不易导致过时，floating-minor 最不易导致脆弱。作者据此建议开发者采用任意浮动约束并配合 lockfile，以平衡固定与浮动的利弊。
Developers consistently use version constraints to specify acceptable versions of the dependencies for their project. Pinning dependencies can reduce the likelihood of breaking changes, but comes with a cost of manually managing the replacement of outdated and vulnerable dependencies. On the other hand, floating can be used to automatically get bug fixes and security fixes, but comes with the risk of breaking changes. Security practitioners advocate pinning dependencies to prevent against software supply chain attacks, e.g., malicious package updates. However, since pinning is the tightest version constraint, pinning is the most likely to result in outdated dependencies. Nevertheless, how the likelihood of becoming outdated or vulnerable dependencies changes across version constraint types is unknown. The goal of this study is to aid developers in making an informed dependency version constraint choice by empirically evaluating the likelihood of dependencies becoming outdated or vulnerable across version constraint types at scale. In this study, we first identify the trends in dependency version constraint usage and the patterns of version constraint type changes made by developers in the npm, PyPI, and Cargo ecosystems. We then modeled the dependency state transitions using survival analysis and estimated how the likelihood of becoming outdated or vulnerable changes when using pinning as opposed to the rest of the version constraint types. We observe that among outdated and vulnerable dependencies, the most commonly used version constraint type is floating-minor, with pinning being the next most common. We also find that floating-major is the least likely to result in outdated and floating-minor is the least likely to result in vulnerable dependencies. Based on our findings, we recommend that developers use any kind of floating constraint with lockfiles to balance the tradeoffs of pinning and floating.
@inproceedings{paperbot9498,
title = {Which Is Better For Reducing Outdated and Vulnerable Dependencies: Pinning or Floatingƒ},
author = {Imranur Rahman and Jill Marley and William Enck and Laurie Williams},
booktitle = {ASE},
year = {2025},
doi = {10.1109/ase63991.2025.00229}
}