{"id":"https://openalex.org/W4411272046","doi":"https://doi.org/10.1109/msr66628.2025.00100","title":"How Do Infrastructure-as-Code Practitioners Update Their Dependencies? An Empirical Study on Terraform Module Updates","display_name":"How Do Infrastructure-as-Code Practitioners Update Their Dependencies? An Empirical Study on Terraform Module Updates","publication_year":2025,"publication_date":"2025-04-28","ids":{"openalex":"https://openalex.org/W4411272046","doi":"https://doi.org/10.1109/msr66628.2025.00100"},"language":"en","primary_location":{"id":"doi:10.1109/msr66628.2025.00100","doi":"https://doi.org/10.1109/msr66628.2025.00100","is_oa":false,"landing_page_url":"https://doi.org/10.1109/msr66628.2025.00100","pdf_url":null,"source":{"id":"https://openalex.org/S7407088599","display_name":"International Conference on Mining Software Repositories (MSR)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 IEEE/ACM 22nd International Conference on Mining Software Repositories (MSR)","raw_type":"proceedings-article"},"volume":null,"type":"conference-paper","is_traditional":true,"indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5093221251","display_name":"Mahi Begoug","orcid":"https://orcid.org/0009-0007-5914-9968","observed_orcids":["https://orcid.org/0009-0007-5914-9968"]},"institutions":[{"id":"https://openalex.org/I9736820","display_name":"\u00c9cole de Technologie Sup\u00e9rieure","ror":"https://ror.org/0020snb74","country_code":"CA","type":"education","lineage":["https://openalex.org/I49663120","https://openalex.org/I9736820"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Mahi Begoug","raw_affiliation_strings":["ETS Montreal, University of Quebec,Montreal,QC,Canada"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"ETS Montreal, University of Quebec,Montreal,QC,Canada","institution_ids":["https://openalex.org/I9736820"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5090942200","display_name":"Ali Ouni","orcid":"https://orcid.org/0000-0003-4708-0362","observed_orcids":["https://orcid.org/0000-0003-4708-0362"]},"institutions":[{"id":"https://openalex.org/I9736820","display_name":"\u00c9cole de Technologie Sup\u00e9rieure","ror":"https://ror.org/0020snb74","country_code":"CA","type":"education","lineage":["https://openalex.org/I49663120","https://openalex.org/I9736820"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Ali Ouni","raw_affiliation_strings":["ETS Montreal, University of Quebec,Montreal,QC,Canada"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"ETS Montreal, University of Quebec,Montreal,QC,Canada","institution_ids":["https://openalex.org/I9736820"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5081978873","display_name":"Moataz Chouchen","orcid":"https://orcid.org/0000-0002-1134-1324","observed_orcids":["https://orcid.org/0000-0002-1134-1324"]},"institutions":[{"id":"https://openalex.org/I60158472","display_name":"Concordia University","ror":"https://ror.org/0420zvk78","country_code":"CA","type":"education","lineage":["https://openalex.org/I60158472"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Moataz Chouchen","raw_affiliation_strings":["Concordia University,Montreal,QC,Canada"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Concordia University,Montreal,QC,Canada","institution_ids":["https://openalex.org/I60158472"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":2.1261,"has_fulltext":false,"cited_by_count":4,"citation_normalized_percentile":{"value":0.88541336,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":93,"max":96},"biblio":{"volume":null,"issue":null,"first_page":"642","last_page":"653"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.9688000082969666,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.9688000082969666,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10430","display_name":"Software Engineering Techniques and Practices","score":0.02419999986886978,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.003700000001117587,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/infrastructure-as-code","display_name":"infrastructure as code","score":0.9549999833106995},{"id":"https://openalex.org/keywords/terraform","display_name":"Terraform","score":0.9520000219345093},{"id":"https://openalex.org/keywords/update-frequency","display_name":"update frequency","score":0.7940000295639038},{"id":"https://openalex.org/keywords/practitioner-motivation","display_name":"practitioner motivation","score":0.7390000224113464},{"id":"https://openalex.org/keywords/security-vulnerabilities","display_name":"security vulnerabilities","score":0.75},{"id":"https://openalex.org/keywords/code-quality","display_name":"code quality","score":0.6869999766349792},{"id":"https://openalex.org/keywords/open-source-projects","display_name":"open source projects","score":0.6330000162124634},{"id":"https://openalex.org/keywords/commit-analysis","display_name":"commit analysis","score":0.5389999747276306}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7742478847503662},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.5272922515869141},{"id":"https://openalex.org/C120936955","wikidata":"https://www.wikidata.org/wiki/Q2155640","display_name":"Empirical research","level":2,"score":0.448814332485199},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.3746146559715271},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.0},{"id":"https://openalex.org/C111472728","wikidata":"https://www.wikidata.org/wiki/Q9471","display_name":"Epistemology","level":1,"score":0.0},{"id":"https://openalex.org/C138885662","wikidata":"https://www.wikidata.org/wiki/Q5891","display_name":"Philosophy","level":0,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1109/msr66628.2025.00100","doi":"https://doi.org/10.1109/msr66628.2025.00100","is_oa":false,"landing_page_url":"https://doi.org/10.1109/msr66628.2025.00100","pdf_url":null,"source":{"id":"https://openalex.org/S7407088599","display_name":"International Conference on Mining Software Repositories (MSR)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 IEEE/ACM 22nd International Conference on Mining Software Repositories (MSR)","raw_type":"proceedings-article"},{"id":"pmh:oai:espace2.etsmtl.ca:31149","doi":null,"is_oa":false,"landing_page_url":"https://espace2.etsmtl.ca/id/eprint/31149/","pdf_url":null,"source":{"id":"https://openalex.org/S4306402392","display_name":"Espace \u00c9TS (ETS)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I9736820","host_organization_name":"\u00c9cole de Technologie Sup\u00e9rieure","host_organization_lineage":["https://openalex.org/I9736820"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Compte rendu de conf\u00e9rence"}],"best_oa_location":null,"sustainable_development_goals":[{"display_name":"Industry, innovation and infrastructure","score":0.5378999710083008,"id":"https://metadata.un.org/sdg/9"}],"study_designs":[],"awards":[],"funders":[{"id":"https://openalex.org/F4320334593","display_name":"Natural Sciences and Engineering Research Council of Canada","ror":"https://ror.org/01h531d29"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":43,"referenced_works":["https://openalex.org/W1969939902","https://openalex.org/W2402800985","https://openalex.org/W2476494490","https://openalex.org/W2767231363","https://openalex.org/W2789570312","https://openalex.org/W2801591443","https://openalex.org/W2883146311","https://openalex.org/W2899407111","https://openalex.org/W2922836104","https://openalex.org/W2945486631","https://openalex.org/W2953482240","https://openalex.org/W2953686539","https://openalex.org/W2963923573","https://openalex.org/W2969657790","https://openalex.org/W2993710525","https://openalex.org/W3024062390","https://openalex.org/W3030599819","https://openalex.org/W3088716235","https://openalex.org/W3099026746","https://openalex.org/W3101141194","https://openalex.org/W3114813405","https://openalex.org/W3121596715","https://openalex.org/W3144106047","https://openalex.org/W3145166639","https://openalex.org/W3160362293","https://openalex.org/W3195172275","https://openalex.org/W3195348753","https://openalex.org/W3196126762","https://openalex.org/W4205924012","https://openalex.org/W4232488826","https://openalex.org/W4238083912","https://openalex.org/W4302039922","https://openalex.org/W4312348571","https://openalex.org/W4312695097","https://openalex.org/W4379014622","https://openalex.org/W4388487891","https://openalex.org/W4399631545","https://openalex.org/W4400681240","https://openalex.org/W4401543865","https://openalex.org/W4401544034","https://openalex.org/W4402456068","https://openalex.org/W4408054408","https://openalex.org/W6855499216"],"related_works":["https://openalex.org/W4405093949","https://openalex.org/W7167723388","https://openalex.org/W7133013318","https://openalex.org/W4388487891","https://openalex.org/W7221024113","https://openalex.org/W7168187631","https://openalex.org/W4411232812","https://openalex.org/W4409833316","https://openalex.org/W4411272026","https://openalex.org/W2993710525"],"abstract_inverted_index":{"Infrastructure-as-Code":[0],"(IaC)":[1],"enables":[2],"practitioners":[3,54,114,223,252],"to":[4,36,82,135,212],"configure":[5],"and":[6,20,139,236],"manage":[7],"software":[8,62],"infrastructure":[9,130],"through":[10],"machine-readable":[11],"code":[12,18,205],"files.":[13],"Various":[14],"IaC":[15,23,34,57,88,102,113,230,237,255],"tools":[16],"facilitate":[17],"reuse":[19],"modularity":[21],"via":[22],"modules":[24,30],"that":[25,128,143,166,221,250],"act":[26],"as":[27,68,70],"dependencies.":[28,176],"These":[29],"are":[31],"maintained":[32],"by":[33,193],"providers":[35],"introduce":[37],"new":[38],"features,":[39],"resolve":[40],"bugs,":[41],"or":[42],"address":[43],"security":[44],"vulnerabilities.":[45],"However,":[46],"there":[47],"is":[48],"a":[49,198],"limited":[50],"understanding":[51],"of":[52,98,169],"how":[53],"update":[55,85,115],"their":[56,61,116,136],"module":[58,89,117,175,209,260],"dependencies":[59,210],"in":[60,87,111],"projects,":[63],"including":[64],"updates":[65,211,262],"frequency,":[66],"delays,":[67],"well":[69],"motivations":[71,142,215],"behind":[72,216],"such":[73,217],"updates.":[74,146,218],"To":[75,147],"fill":[76],"this":[77,79],"gap,":[78],"paper":[80],"aims":[81],"understand":[83],"current":[84],"practices":[86],"dependencies,":[90,118],"focusing":[91],"on":[92,155,191,204],"Terraform":[93],"(TF),":[94],"being":[95,241],"currently":[96],"one":[97],"the":[99,109,120,126,129,141,170,242],"most":[100,244],"popular":[101],"tools.":[103],"In":[104],"particular,":[105],"we":[106,150,178,196],"investigate":[107,213],"(i)":[108],"frequency":[110],"which":[112,124],"(ii)":[119],"technical":[121,182],"lag":[122,183],"phenomena,":[123],"represents":[125],"time":[127],"configurations":[131],"remain":[132],"outdated":[133],"relative":[134],"upstream":[137],"modules,":[138],"(iii)":[140],"drive":[144],"these":[145],"achieve":[148],"these,":[149],"conduct":[151,197],"an":[152,180],"empirical":[153],"study":[154,200],"13,490":[156],"TF-related":[157],"commits":[158,172],"from":[159,184],"131":[160],"open-source":[161],"projects.":[162],"Our":[163,247],"results":[164],"reveal":[165],"only":[167],"1.2%":[168],"analyzed":[171],"involve":[173],"updating":[174],"Furthermore,":[177],"observe":[179],"increasing":[181],"2021":[185],"until":[186],"2024,":[187],"reaching":[188],"ten":[189],"months":[190],"average":[192],"2024.":[194],"Then,":[195],"qualitative":[199],"using":[201],"thematic":[202],"analysis":[203],"changes":[206],"involving":[207],"TF":[208,222,251],"practitioners\u2019":[214],"We":[219],"identify":[220],"revolve":[224],"around":[225],"six":[226],"main":[227],"motivations,":[228],"with":[229],"Ecosystem":[231],"Compatibility,":[232],"Security":[233],"Vulnerabilities":[234],"Fixes,":[235],"Code":[238],"Quality":[239],"Improvement":[240],"three":[243],"prevalent":[245],"motivations.":[246],"findings":[248],"advocate":[249],"need":[253],"customized":[254],"tool":[256],"support":[257],"for":[258],"safe":[259],"dependency":[261],"while":[263],"addressing":[264],"compatibility":[265],"concerns.":[266]},"counts_by_year":[{"year":2026,"cited_by_count":2},{"year":2025,"cited_by_count":2}],"updated_date":"2026-11-10T11:39:43.021295","created_date":"2025-10-10T00:00:00"}