cid f3d9726b8aef62d82dd3f85610ca402871b74fce2d29ea9309f87d5d0a63ca40 · original · open access · via openalex
Title: Dependency Networks of Open Source Libraries Available Through CocoaPods, Carthage and Swift PM Authors: Kristiina Rahkema; Dietmar Pfahl Venue: Zenodo (CERN European Organization for Nuclear Research) Year: 2022 Canonical: doi:10.5281/zenodo.6376008 URL: https://doi.org/10.5281/zenodo.6376008 Collector: openalex OA: true ABSTRACT Third party libraries are used to integrate existing solutions for common problems and help speed up development. The use of third party libraries, however, can carry risks, for example through vulnerabilities in these libraries. Studying the dependency networks of package managers lets us better understand and mitigate these risks. So far, the dependency networks of the three most important package managers of the Apple ecosystem, CocoaPods, Carthage and Swift PM, have not been studied. We analysed the dependencies for all publicly available open source libraries up to December 2021 and compiled a dataset containing the dependency networks of all three package managers. The dependency networks can be used to analyse how vulnerabilities are propagated through transitive dependencies. In order to ease the tracing of vulnerable libraries we also queried the NVD database and included publicly reported vulnerabilities for these libraries in the dataset.