# An Empirical Comparison of Dependency Network Evolution in Seven Software Packaging Ecosystems

arXiv: https://arxiv.org/abs/1710.04936 · HTML: https://mlsanity.com/paper/1710.04936/

## Key facts

- Cited by 20 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 13 Oct 2017.

## Built on by (most cited first, 20 of 20)

- [An Empirical Study of Pre-Trained Model Reuse in the Hugging Face Deep Learning Model Registry](https://mlsanity.com/paper/2303.02552/) (2023)
- [What do we know about Hugging Face? A systematic literature review and quantitative validation of qualitative claims](https://mlsanity.com/paper/2406.08205/) (2024)
- [Towards a Change Taxonomy for Machine Learning Systems](https://mlsanity.com/paper/2203.11365/) (2022)
- [AI-Generated Code Is Not Reproducible (Yet): An Empirical Study of Dependency Gaps in LLM-Based Coding Agents](https://mlsanity.com/paper/2512.22387/) (2025)
- [Skills Are Not Islands: Measuring Dependency and Risk in Agent Skill Supply Chains](https://mlsanity.com/paper/2607.01136/) (2026)
- [An Empirical Study of Library Usage and Dependency in Deep Learning Frameworks](https://mlsanity.com/paper/2211.15733/) (2022)
- [How Robust are LLM-Generated Library Imports? An Empirical Study using Stack Overflow](https://mlsanity.com/paper/2507.10818/) (2025)
- [Empirical Evaluation of AI-Assisted Software Package Selection: A Knowledge Graph Approach](https://mlsanity.com/paper/2508.05693/) (2025)
- [ADK Arena: Evaluating Agent Development Kits via LLM-as-a-Developer](https://mlsanity.com/paper/2606.05548/) (2026)
- [From Registry to Repository: How AI Agent Skills Are Written, Adapted, and Maintained](https://mlsanity.com/paper/2607.00911/) (2026)
- [Investigating Security Implications of Automatically Generated Code on the Software Supply Chain](https://mlsanity.com/paper/2509.20277/) (2025)
- [LLMs as Packagers of HPC Software](https://mlsanity.com/paper/2511.05626/) (2025)
- [RepoRescue: An Empirical Study of LLM Agents on Whole-Repository Compatibility Rescue](https://mlsanity.com/paper/2607.01213/) (2026)
- [Call Graph Evolution Analytics over a Version Series of an Evolving Software System](https://mlsanity.com/paper/2210.08316/) (2022)
- [DepRadar: Agentic Coordination for Context Aware Defect Impact Analysis in Deep Learning Libraries](https://mlsanity.com/paper/2601.09440/) (2026)
- [CCCE: A Continuous Code Calibration Engine for Autonomous Enterprise Codebase Maintenance via Knowledge Graph Traversal and Adaptive Decision Gating](https://mlsanity.com/paper/2604.13102/) (2026)
- [Agentic Generation of AST Transformation Rules for Fixing Breaking Updates](https://mlsanity.com/paper/2606.24446/) (2026)
- [Govern the Repository, Not the Agent: Measuring Ecosystem-Level Risk in AI-Native Software](https://mlsanity.com/paper/2606.28235/) (2026)
- [On the Maintenance and Co-evolution of Agent Plugins: An Empirical Study of Claude Code Plugin Marketplaces](https://mlsanity.com/paper/2608.28497/) (2026)
- [After the Party: Growth, Governance, and Security Scanning in the OpenClaw Agent Skill Ecosystem](https://mlsanity.com/paper/2609.17274/) (2026)

## Abstract (arXiv)

Nearly every popular programming language comes with one or more package managers. The software packages distributed by such package managers form large software ecosystems. These packaging ecosystems contain a large number of package releases that are updated regularly and that have many dependencies to other package releases. While packaging ecosystems are extremely useful for their respective communities of developers, they face challenges related to their scale, complexity, and rate of evolution. Typical problems are backward incompatible package updates, and the risk of (transitively) depending on packages that have become obsolete or inactive. This manuscript uses the libraries.io dataset to carry out a quantitative empirical analysis of the similarities and differences between the evolution of package dependency networks for seven packaging ecosystems of varying sizes and ages: Cargo for Rust, CPAN for Perl, CRAN for R, npm for JavaScript, NuGet for the .NET platform, Packagist for PHP, and RubyGems for Ruby. We propose novel metrics to capture the growth, changeability, resuability and fragility of these dependency networks, and use these metrics to analyse and compare their evolution. We observe that the dependency networks tend to grow over time, both in size and in number of package updates, while a minority of packages are responsible for most of the package updates. The majority of packages depend on other packages, but only a small proportion of packages accounts for most of the reverse dependencies. We observe a high proportion of fragile packages due to a high and increasing number of transitive dependencies. These findings are instrumental for assessing the quality of a package dependency network, and improving it through dependency management tools and imposed policies.