Problem
Research questions and friction points this paper is trying to address.
dependency resolution
software ecosystems
release points
package management
historical analysis
CHRONO-RESOLUTION: A Dependency Resolution Dataset at Release Points for npm, PyPI, and crates.io Packages
🤖 AI Summary
Mainstream software ecosystems lack support for historical time-point dependency relationships, hindering research on software evolution and dynamic metrics. This work proposes a dependency graph construction method grounded in package release timestamps and integrates OSV vulnerability data to systematically reconstruct, for the first time, the historical dependency states of the npm, PyPI, and crates.io ecosystems. The resulting large-scale, multi-ecosystem dataset, CHRONO-RESOLUTION, is publicly released and addresses a critical gap in software supply chain analysis by enabling empirical studies of dynamic properties such as dependency freshness and update cadence.
📝 Abstract
Dependency resolution at a specified point in time in the past can provide insight into software evolution in software ecosystems and facilitate the design of dynamic metrics (e.g., dependency freshness, dependency update rhythm). However, dependency resolution at specified points in time is not possible in major software ecosystems due to a lack of support from package management tools. The goal of this paper is to aid practitioners and researchers in analyzing the state of the ecosystem dependency graph at release points using an enriched dataset with dependency resolution at release points for npm, PyPI, and crates.io packages. In this paper, we present a methodology to construct dependency resolution at release points of packages in software ecosystems, which we enrich with vulnerability data from OSV. We apply our methodology to construct CHRONO-RESOLUTION, a dataset of dependency resolution at release points for npm, PyPI, and crates.io packages, and release it for future research.
Innovation
Methods, ideas, or system contributions that make the work stand out.
dependency resolution
software ecosystems
release points
vulnerability data
CHRONO-RESOLUTION
🔎 Similar Papers
💼 Related Jobs
