# Which Is Better For Reducing Outdated and Vulnerable Dependencies: Pinning or Floating?

arXiv: https://arxiv.org/abs/2510.08609 · HTML: https://mlsanity.com/paper/2510.08609/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 16 of its 55 references that are in the map.
- First posted on arXiv 7 Oct 2025.

## Builds on (most cited first, 16 of 16)

- [Taxonomy of Attacks on Open-Source Software Supply Chains](https://mlsanity.com/paper/2204.04008/) (2022)
- [Do Developers Update Their Library Dependencies? An Empirical Study on the Impact of Security Advisories on Library Migration](https://mlsanity.com/paper/1709.04621/) (2017)
- [An Empirical Study of Usages, Updates and Risks of Third-Party Libraries in Java Projects](https://mlsanity.com/paper/2002.11028/) (2020)
- [Why Modern Open Source Projects Fail](https://mlsanity.com/paper/1707.02327/) (2017)
- [Vulnerable Open Source Dependencies: Counting Those That Matter](https://mlsanity.com/paper/1808.09753/) (2018)
- [OpenSSF Scorecard: On the Path Toward Ecosystem-wide Automated Security Metrics](https://mlsanity.com/paper/2208.03412/) (2022)
- [A Closer Look at the Security Risks in the Rust Ecosystem](https://mlsanity.com/paper/2308.15046/) (2023)
- [Empirical Analysis of Vulnerabilities Life Cycle in Golang Ecosystem](https://mlsanity.com/paper/2401.00515/) (2023)
- [Dependency Smells in JavaScript Projects](https://mlsanity.com/paper/2010.14573/) (2020)
- [On the Effect of Transitivity and Granularity on Vulnerability Propagation in the Maven Ecosystem](https://mlsanity.com/paper/2301.07972/) (2023)
- [Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks](https://mlsanity.com/paper/2502.06662/) (2025)
- [DepsRAG: Towards Agentic Reasoning and Planning for Software Dependency Management](https://mlsanity.com/paper/2405.20455/) (2024)
- [Using the Uniqueness of Global Identifiers to Determine the Provenance of Python Software Source Code](https://mlsanity.com/paper/2305.14837/) (2023)
- [A Large Scale Analysis of Semantic Versioning in NPM](https://mlsanity.com/paper/2304.00394/) (2023)
- [A Large-Scale Empirical Study on Semantic Versioning in Golang Ecosystem](https://mlsanity.com/paper/2309.02894/) (2023)
- [Detecting and removing bloated dependencies in CommonJS packages](https://mlsanity.com/paper/2405.17939/) (2024)

## Abstract (arXiv)

Developers consistently use version constraints to specify acceptable versions of the dependencies for their project. Pinning dependencies can reduce the likelihood of breaking changes, but comes with a cost of manually managing the replacement of outdated and vulnerable dependencies. On the other hand, floating can be used to automatically get bug fixes and security fixes, but comes with the risk of breaking changes. Security practitioners advocate pinning dependencies to prevent against software supply chain attacks, e.g., malicious package updates. However, since pinning is the tightest version constraint, pinning is the most likely to result in outdated dependencies. Nevertheless, how the likelihood of becoming outdated or vulnerable dependencies changes across version constraint types is unknown. The goal of this study is to aid developers in making an informed dependency version constraint choice by empirically evaluating the likelihood of dependencies becoming outdated or vulnerable across version constraint types at scale. In this study, we first identify the trends in dependency version constraint usage and the patterns of version constraint type changes made by developers in the npm, PyPI, and Cargo ecosystems. We then modeled the dependency state transitions using survival analysis and estimated how the likelihood of becoming outdated or vulnerable changes when using pinning as opposed to the rest of the version constraint types. We observe that among outdated and vulnerable dependencies, the most commonly used version constraint type is floating-minor, with pinning being the next most common. We also find that floating-major is the least likely to result in outdated and floating-minor is the least likely to result in vulnerable dependencies.