Online / 5 & 6 February 2022


On Backporting Practices in Package Dependency Networks

The practice of backporting aims to bring the benefits of a bug or vulnerability fix from a higher to a lower release of a software package. When such a package adheres to semantic versioning, backports can be recognised as new releases in a lower major train. This is particularly useful in case a substantial number of software packages continues to depend on that lower major train. In this talk, we discuss the backporting practices in four popular package distributions, namely Cargo, npm, Packagist and RubyGems. We observe that many dependent packages could benefit from backports provided by their dependencies. In particular, we find that a majority of security vulnerabilities affect more than one major train but are only fixed in the highest one, letting thousands of dependent packages exposed to the vulnerability. Despite that, we find that backporting updates is quite infrequent, and mostly practised by long-lived and more active packages for a variety of reasons.

The full paper associated with this talk can be found at The research has been carried out in the context of the Belgian SECOASSIST "Excellence of Science" Research Project


Photo of Ahmed Zerouali Ahmed Zerouali
Photo of Tom Mens Tom Mens