{"id":"https://openalex.org/W4401109317","doi":"https://doi.org/10.1007/s10664-024-10523-y","title":"Dependabot and security pull requests: large empirical study","display_name":"Dependabot and security pull requests: large empirical study","publication_year":2024,"publication_date":"2024-07-30","ids":{"openalex":"https://openalex.org/W4401109317","doi":"https://doi.org/10.1007/s10664-024-10523-y"},"language":"en","primary_location":{"id":"doi:10.1007/s10664-024-10523-y","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s10664-024-10523-y","pdf_url":null,"source":{"id":"https://openalex.org/S109852484","display_name":"Empirical Software Engineering","issn_l":"1382-3256","issn":["1382-3256","1573-7616"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Empirical Software Engineering","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://doi.org/10.1007/s10664-024-10523-y","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5105961183","display_name":"Hocine Rebatchi","orcid":"https://orcid.org/0009-0009-3657-8510"},"institutions":[{"id":"https://openalex.org/I9736820","display_name":"\u00c9cole de Technologie Sup\u00e9rieure","ror":"https://ror.org/0020snb74","country_code":"CA","type":"education","lineage":["https://openalex.org/I49663120","https://openalex.org/I9736820"]}],"countries":["CA"],"is_corresponding":true,"raw_author_name":"Hocine Rebatchi","raw_affiliation_strings":["\u00c9cole de Technologie Sup\u00e9rieure, Montreal, Canada"],"raw_orcid":"https://orcid.org/0009-0009-3657-8510","affiliations":[{"raw_affiliation_string":"\u00c9cole de Technologie Sup\u00e9rieure, Montreal, Canada","institution_ids":["https://openalex.org/I9736820"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5082835974","display_name":"Tegawend\u00e9 F. Bissyand\u00e9","orcid":"https://orcid.org/0000-0001-7270-9869"},"institutions":[{"id":"https://openalex.org/I186903577","display_name":"University of Luxembourg","ror":"https://ror.org/036x5ad56","country_code":"LU","type":"education","lineage":["https://openalex.org/I186903577"]}],"countries":["LU"],"is_corresponding":true,"raw_author_name":"T\u00e9gawend\u00e9 F. Bissyand\u00e9","raw_affiliation_strings":["University of Luxembourg, Luxembourg City, Luxembourg"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Luxembourg, Luxembourg City, Luxembourg","institution_ids":["https://openalex.org/I186903577"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5007508017","display_name":"Naouel Moha","orcid":"https://orcid.org/0000-0001-9252-9937"},"institutions":[{"id":"https://openalex.org/I9736820","display_name":"\u00c9cole de Technologie Sup\u00e9rieure","ror":"https://ror.org/0020snb74","country_code":"CA","type":"education","lineage":["https://openalex.org/I49663120","https://openalex.org/I9736820"]}],"countries":["CA"],"is_corresponding":true,"raw_author_name":"Naouel Moha","raw_affiliation_strings":["\u00c9cole de Technologie Sup\u00e9rieure, Montreal, Canada"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"\u00c9cole de Technologie Sup\u00e9rieure, Montreal, Canada","institution_ids":["https://openalex.org/I9736820"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":2,"corresponding_author_ids":["https://openalex.org/A5007508017","https://openalex.org/A5082835974","https://openalex.org/A5105961183"],"corresponding_institution_ids":["https://openalex.org/I186903577","https://openalex.org/I9736820"],"apc_list":{"value":2890,"currency":"USD","value_usd":2890},"apc_paid":{"value":2890,"currency":"USD","value_usd":2890},"fwci":1.0632,"has_fulltext":true,"cited_by_count":5,"citation_normalized_percentile":{"value":0.7518166,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":94,"max":98},"biblio":{"volume":"29","issue":"5","first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9984999895095825,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9984999895095825,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.9970999956130981,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.996999979019165,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.49814558029174805},{"id":"https://openalex.org/keywords/empirical-research","display_name":"Empirical research","score":0.43306082487106323},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.37361401319503784},{"id":"https://openalex.org/keywords/statistics","display_name":"Statistics","score":0.09929540753364563},{"id":"https://openalex.org/keywords/mathematics","display_name":"Mathematics","score":0.08341845870018005}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.49814558029174805},{"id":"https://openalex.org/C120936955","wikidata":"https://www.wikidata.org/wiki/Q2155640","display_name":"Empirical research","level":2,"score":0.43306082487106323},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.37361401319503784},{"id":"https://openalex.org/C105795698","wikidata":"https://www.wikidata.org/wiki/Q12483","display_name":"Statistics","level":1,"score":0.09929540753364563},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.08341845870018005}],"mesh":[],"locations_count":3,"locations":[{"id":"doi:10.1007/s10664-024-10523-y","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s10664-024-10523-y","pdf_url":null,"source":{"id":"https://openalex.org/S109852484","display_name":"Empirical Software Engineering","issn_l":"1382-3256","issn":["1382-3256","1573-7616"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Empirical Software Engineering","raw_type":"journal-article"},{"id":"pmh:oai:orbilu.uni.lu:10993/62972","is_oa":true,"landing_page_url":"https://orbilu.uni.lu/handle/10993/62972","pdf_url":"https://orbilu.uni.lu/bitstream/10993/62972/1/s10664-024-10523-y%20%281%29.pdf","source":{"id":"https://openalex.org/S4306401815","display_name":"Open Repository and Bibliography (University of Luxembourg)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I186903577","host_organization_name":"University of Luxembourg","host_organization_lineage":["https://openalex.org/I186903577"],"host_organization_lineage_names":[],"type":"repository"},"license":"other-oa","license_id":"https://openalex.org/licenses/other-oa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Empirical Software Engineering, 29 (5) (2024-09)","raw_type":"http://purl.org/coar/resource_type/c_6501"},{"id":"pmh:oai:espace2.etsmtl.ca:29178","is_oa":false,"landing_page_url":"https://espace2.etsmtl.ca/id/eprint/29178/","pdf_url":null,"source":{"id":"https://openalex.org/S4306402392","display_name":"Espace \u00c9TS (ETS)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I1341030882","host_organization_name":"Educational Testing Service","host_organization_lineage":["https://openalex.org/I1341030882"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"","raw_type":"Article publi\u00e9 dans une revue, r\u00e9vis\u00e9 par les pairs"}],"best_oa_location":{"id":"doi:10.1007/s10664-024-10523-y","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s10664-024-10523-y","pdf_url":null,"source":{"id":"https://openalex.org/S109852484","display_name":"Empirical Software Engineering","issn_l":"1382-3256","issn":["1382-3256","1573-7616"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Empirical Software Engineering","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G1956222819","display_name":null,"funder_award_id":"949014","funder_id":"https://openalex.org/F4320320300","funder_display_name":"European Commission"}],"funders":[{"id":"https://openalex.org/F4320320300","display_name":"European Commission","ror":"https://ror.org/00k4n6c32"},{"id":"https://openalex.org/F4320334593","display_name":"Natural Sciences and Engineering Research Council of Canada","ror":"https://ror.org/01h531d29"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":49,"referenced_works":["https://openalex.org/W1818897895","https://openalex.org/W2012720140","https://openalex.org/W2107564263","https://openalex.org/W2112357885","https://openalex.org/W2125854594","https://openalex.org/W2139092060","https://openalex.org/W2140952846","https://openalex.org/W2148854374","https://openalex.org/W2223652430","https://openalex.org/W2547772497","https://openalex.org/W2559885217","https://openalex.org/W2765858138","https://openalex.org/W2767231363","https://openalex.org/W2789570312","https://openalex.org/W2807825607","https://openalex.org/W2886368623","https://openalex.org/W2899117127","https://openalex.org/W2913584116","https://openalex.org/W2953558274","https://openalex.org/W2953795759","https://openalex.org/W2962960733","https://openalex.org/W3008371681","https://openalex.org/W3009640336","https://openalex.org/W3046453918","https://openalex.org/W3081194266","https://openalex.org/W3087802366","https://openalex.org/W3090088279","https://openalex.org/W3094949573","https://openalex.org/W3105446266","https://openalex.org/W3106855263","https://openalex.org/W3111602563","https://openalex.org/W3138230581","https://openalex.org/W3159300567","https://openalex.org/W3161628085","https://openalex.org/W3172189288","https://openalex.org/W3177321543","https://openalex.org/W3192303722","https://openalex.org/W3196043647","https://openalex.org/W3206246417","https://openalex.org/W4210924384","https://openalex.org/W4221141539","https://openalex.org/W4243240013","https://openalex.org/W4251460506","https://openalex.org/W4283076946","https://openalex.org/W4285176706","https://openalex.org/W4308562662","https://openalex.org/W4312615339","https://openalex.org/W4313419628","https://openalex.org/W4328029637"],"related_works":["https://openalex.org/W4391375266","https://openalex.org/W2748952813","https://openalex.org/W2390279801","https://openalex.org/W2358668433","https://openalex.org/W4396701345","https://openalex.org/W2376932109","https://openalex.org/W2001405890","https://openalex.org/W4396696052","https://openalex.org/W2382290278","https://openalex.org/W4395014643"],"abstract_inverted_index":{"Modern":[0],"software":[1,49,90,178],"development":[2,91],"is":[3,66,81],"a":[4,89,101,147,163,183,254,283,288,301],"complex":[5],"engineering":[6],"process":[7],"where":[8],"developer":[9,425],"code":[10,29,38],"cohabits":[11],"with":[12,31,55,214,240,434],"an":[13],"increasingly":[14],"larger":[15],"number":[16],"of":[17,45,77,109,135,172,176,201,207,221,243,256,291,319,332,349,386,411,419,440],"external":[18],"open-source":[19,138],"components.":[20],"Even":[21],"though":[22],"these":[23],"components":[24],"facilitate":[25],"sharing":[26],"and":[27,37,114,132,168,190,199,210,229,233,246,294,330,358,365,396,426,437],"reusing":[28],"along":[30],"other":[32,71],"benefits":[33],"related":[34],"to":[35,53,63,67,84,100,106,128,161,194,212,276,303,325,352,369,404,430],"maintenance":[36],"quality,":[39],"they":[40],"are":[41,362,376,398],"often":[42],"the":[43,48,110,130,133,170,174,177,197,205,219,226,230,235,241,277,292,347,366,384,405,408,417,435],"seeds":[44],"vulnerabilities":[46,136,215,341,388],"in":[47,74,88,137,216,262,378],"supply":[50,179],"chain":[51],"leading":[52],"attacks":[54,65],"severe":[56],"consequences.":[57],"Indeed,":[58],"one":[59,381],"common":[60],"strategy":[61],"used":[62],"conduct":[64],"exploit":[68],"or":[69],"inject":[70],"security":[72,119,191,222,244,360,412,441],"flaws":[73],"new":[75],"versions":[76],"dependency":[78,111,148,188,307,320,340,387,427],"packages.":[79],"It":[80,158],"thus":[82],"important":[83],"keep":[85,107,162],"dependencies":[86,167],"updated":[87],"project.":[92],"Unfortunately,":[93],"several":[94],"prior":[95],"studies":[96],"have":[97,125],"highlighted":[98],"that,":[99],"large":[102,184],"extent,":[103],"developers":[104,160,304,338],"struggle":[105],"track":[108],"package":[112],"updates,":[113],"do":[115],"not":[116],"quickly":[117],"incorporate":[118],"patches.":[120],"Therefore,":[121],"automated":[122],"dependency-update":[123],"bots":[124],"been":[126],"proposed":[127],"mitigate":[129],"impact":[131],"emergence":[134],"projects.":[139],"In":[140,274],"our":[141,297],"study,":[142],"we":[143,252,281,295],"focus":[144],"on":[145,155,165,187,265,287,346,394,407],"Dependabot,":[146],"management":[149,220,308,321],"bot":[150],"that":[151,237,250,305,313,337,374],"has":[152],"gained":[153],"popularity":[154],"GitHub":[156,266],"recently.":[157],"allows":[159,368],"lookout":[164],"project":[166,415],"reduce":[169],"effort":[171,410],"monitoring":[173],"safety":[175],"chain.":[180],"We":[181,334],"performed":[182,282],"empirical":[185],"study":[186,311],"updates":[189],"pull":[192,223,258],"requests":[193,224],"understand:":[195],"(1)":[196],"degree":[198],"reasons":[200],"Dependabot\u2019s":[202,357],"popularity;":[203],"(2)":[204],"patterns":[206],"developers\u2019":[208,359],"practices":[209],"techniques":[211],"deal":[213],"dependencies;":[217],"(3)":[218],"(PRs),":[225],"threat":[227,385],"lifetime,":[228],"fix":[231],"delay;":[232],"(4)":[234],"factors":[236],"significantly":[238],"correlate":[239],"acceptance":[242,436],"PRs":[245,350,361],"fast":[247,438],"merges.":[248],"To":[249],"end,":[251],"collected":[253],"dataset":[255],"9,916,318":[257],"request-related":[259],"issues":[260],"made":[261],"1,743,035":[263],"projects":[264],"for":[267,391],"more":[268,316],"than":[269,317,380],"10":[270],"different":[271],"programming":[272],"languages.":[273],"addition":[275],"comprehensive":[278],"quantitative":[279],"analysis,":[280],"manual":[284,409],"qualitative":[285],"analysis":[286],"representative":[289],"sample":[290],"dataset,":[293],"substantiated":[296],"findings":[298],"by":[299],"sending":[300],"survey":[302],"use":[306],"tools.":[309],"Our":[310],"shows":[312],"Dependabot":[314],"dominates":[315],"65%":[318],"activity,":[322],"mainly":[323,344],"due":[324,403],"its":[326],"efficiency,":[327],"accessibility,":[328],"adaptivity,":[329],"availability":[331],"support.":[333],"also":[335],"found":[336],"handle":[339],"differently,":[342],"but":[343],"rely":[345],"automation":[348,367],"generation":[351],"upgrade":[353],"vulnerable":[354],"dependencies.":[355],"Interestingly,":[356],"highly":[363,432],"accepted,":[364],"accelerate":[370],"their":[371],"management,":[372],"so":[373],"fixes":[375],"applied":[377],"less":[379],"day.":[382],"However,":[383],"remains":[389],"hidden":[390],"512":[392],"days":[393,402],"average,":[395],"patches":[397],"disclosed":[399],"after":[400],"362":[401],"reliance":[406],"experts.":[413],"Also,":[414],"characteristics,":[416],"amount":[418],"PR":[420],"changes,":[421],"as":[422,424],"well":[423],"features":[428],"seem":[429],"be":[431],"correlated":[433],"merges":[439],"PRs.":[442]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":4}],"updated_date":"2026-07-30T17:31:21.811387","created_date":"2024-07-31T00:00:00"}