How Quickly Do Development Teams Update Their Vulnerable Dependencies?

Understand

Industry practitioners are increasingly concerned with software that contains vulnerable versions of third-party dependencies that are included both directly and transitively.

• To address this problem, projects are encouraged to both (a)~quickly update to non-vulnerable versions of dependencies and (b)~be mindful of the update practices of the dependencies they choose to use.
• To this end, researchers have proposed metrics to measure the responsiveness of the development teams of the packages in keeping their dependencies updated: Mean-Time-To-Update (MTTU) and Mean-Time-To-Remediate (MTTR).
• While MTTU covers all dependencies, MTTR quantifies the time needed for a package to update its vulnerable dependencies.