cid eb80620cb966e1c54609d42440aec4c876282601e1491e16524113063aaf77d3 · original · open access · via openalex
Title: A Large Scale Analysis of Semantic Versioning in NPM Authors: Donald Pinckney; Federico Cassano; Arjun Guha; Jonathan Bell Venue: International Conference on Mining Software Repositories (MSR) Year: 2023 Canonical: doi:10.1109/msr59073.2023.00073 URL: https://doi.org/10.1109/msr59073.2023.00073 Collector: openalex OA: true ABSTRACT The NPM package repository contains over two million packages and serves tens of billions of downloads per-week. Nearly every single JavaScript application uses the NPM package manager to install packages from the NPM repository. NPM relies on a "semantic versioning" (‘semver’) scheme to maintain a healthy ecosystem, where bug-fixes are reliably delivered to downstream packages as quickly as possible, while breaking changes require manual intervention by downstream package maintainers. In order to understand how developers use semver, we build a dataset containing every version of every package on NPM and analyze the flow of updates throughout the ecosystem. We build a time-travelling dependency resolver for NPM, which allows us to determine precisely which versions of each dependency would have been resolved at different times. We segment our analysis to allow for a direct analysis of security-relevant updates (those that introduce or patch vulnerabilities) in comparison to the rest of the ecosystem. We find that when developers use semver correctly, critical updates such as security patches can flow quite rapidly to downstream dependencies in the majority of cases (90.09%), but this does not always occur, due to developers’ imperfect use of both semver version constraints and semver version number increments. Our findings have implications for developers and researchers alike. We make our infrastructure and dataset publicly available under an open source license.