# Do Developers Update Their Library Dependencies? An Empirical Study on the Impact of Security Advisories on Library Migration

arXiv: https://arxiv.org/abs/1709.04621 · HTML: https://mlsanity.com/paper/1709.04621/

## Key facts

- Cited by 23 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 14 Sep 2017.

## Built on by (most cited first, 23 of 23)

- [Migrating Code At Scale With LLMs At Google](https://mlsanity.com/paper/2504.09691/) (2025)
- [Multi-Granularity Detector for Vulnerability Fixes](https://mlsanity.com/paper/2305.13884/) (2023)
- [MatchFixAgent: Language-Agnostic Autonomous Repository-Level Code Translation Validation and Repair](https://mlsanity.com/paper/2509.16187/) (2025)
- [MELT: Mining Effective Lightweight Transformations from Pull Requests](https://mlsanity.com/paper/2308.14687/) (2023)
- [Risks of ignoring uncertainty propagation in AI-augmented security pipelines](https://mlsanity.com/paper/2407.14540/) (2024)
- [LLM Agents for Automated Dependency Upgrades](https://mlsanity.com/paper/2510.03480/) (2025)
- [SPELL: Synthesis of Programmatic Edits using LLMs](https://mlsanity.com/paper/2602.01107/) (2026)
- [Correct Code, Vulnerable Dependencies: A Large Scale Measurement Study of LLM-Specified Library Versions](https://mlsanity.com/paper/2605.06279/) (2026)
- [RepoRescue: An Empirical Study of LLM Agents on Whole-Repository Compatibility Rescue](https://mlsanity.com/paper/2607.01213/) (2026)
- [Code Ownership in Open-Source AI Software Security](https://mlsanity.com/paper/2312.10861/) (2023)
- [CodeLL: A Lifelong Learning Dataset to Support the Co-Evolution of Data and Language Models of Code](https://mlsanity.com/paper/2312.12492/) (2023)
- [LibRec: Benchmarking Retrieval-Augmented LLMs for Library Migration Recommendations](https://mlsanity.com/paper/2508.09791/) (2025)
- [Which Is Better For Reducing Outdated and Vulnerable Dependencies: Pinning or Floating?](https://mlsanity.com/paper/2510.08609/) (2025)
- [The Invisible Hand of AI Libraries Shaping Open Source Projects and Communities](https://mlsanity.com/paper/2601.01944/) (2026)
- [DepRadar: Agentic Coordination for Context Aware Defect Impact Analysis in Deep Learning Libraries](https://mlsanity.com/paper/2601.09440/) (2026)
- [CCCE: A Continuous Code Calibration Engine for Autonomous Enterprise Codebase Maintenance via Knowledge Graph Traversal and Adaptive Decision Gating](https://mlsanity.com/paper/2604.13102/) (2026)
- [The Impact of Configuring Agentic AI Coding Tools on Build-vs-Buy Decisions: A Study Protocol](https://mlsanity.com/paper/2606.03907/) (2026)
- [Agentic Generation of AST Transformation Rules for Fixing Breaking Updates](https://mlsanity.com/paper/2606.24446/) (2026)
- [LibEvoBench: Probing Temporal Knowledge Stratification in Code Generation Models](https://mlsanity.com/paper/2606.25402/) (2026)
- [An Empirical Study of Model Context Protocol Applications](https://mlsanity.com/paper/2607.25635/) (2026)
- [What Aggregate Scores Miss: Measuring Item-Level Regressions in Commercial LLM API Migrations](https://mlsanity.com/paper/2608.17719/) (2026)
- [Update from Hell: Can Coding Agents Survive Hidden Breakage in Dependency Upgrades?](https://mlsanity.com/paper/2608.30300/) (2026)
- [Escaping Python Dependency Hell: A Hybrid Replay-and-Repair Pipeline for Python Dependency Resolution](https://mlsanity.com/paper/2609.26952/) (2026)

## Abstract (arXiv)

Third-party library reuse has become common practice in contemporary software development, as it includes several benefits for developers. Library dependencies are constantly evolving, with newly added features and patches that fix bugs in older versions. To take full advantage of third-party reuse, developers should always keep up to date with the latest versions of their library dependencies. In this paper, we investigate the extent of which developers update their library dependencies. Specifically, we conducted an empirical study on library migration that covers over 4,600 GitHub software projects and 2,700 library dependencies. Results show that although many of these systems rely heavily on dependencies, 81.5% of the studied systems still keep their outdated dependencies. In the case of updating a vulnerable dependency, the study reveals that affected developers are not likely to respond to a security advisory. Surveying these developers, we find that 69% of the interviewees claim that they were unaware of their vulnerable dependencies. Furthermore, developers are not likely to prioritize library updates, citing it as extra effort and added responsibility. This study concludes that even though third-party reuse is commonplace, the practice of updating a dependency is not as common for many developers.