While open-source software has enabled significant levels of reuse to speed up software development, it has also given rise to the dreadful dependency hell that all software practitioners face on a regular basis. This article provides a catalogue of dependency-related challenges that come with relying on OSS packages or libraries. The catalogue is based on the scientific literature on empirical research that has been conducted to understand, quantify and overcome these challenges. Our overview of this very active research field of package dependency management can be used as a starting point for junior and senior researchers as well as practitioners that would like to learn more about research advances in dealing with the challenges that come with the dependency networks of large OSS package registries.
@article{arxiv.2409.18884,
title = {An Overview and Catalogue of Dependency Challenges in Open Source Software Package Registries},
author = {Tom Mens and Alexandre Decan},
journal= {arXiv preprint arXiv:2409.18884},
year = {2024}
}
Comments
Accepted for BENEVOL24 23rd Belgium-Netherlands Software Evolution Workshop. This updated version includes additional material on SCA tools, as well as an extended section on supply chain attacks, SBOM, SLSA levels