Industry practitioners are increasingly concerned with software that contains vulnerable versions of third-party dependencies that are included both directly and transitively. To address this problem, projects are encouraged to both (a)~quickly update to non-vulnerable versions of dependencies and (b)~be mindful of the update practices of the dependencies they choose to use. To this end, researchers have proposed metrics to measure the responsiveness of the development teams of the packages in keeping their dependencies updated: Mean-Time-To-Update (MTTU) and Mean-Time-To-Remediate (MTTR). While MTTU covers all dependencies, MTTR quantifies the time needed for a package to update its vulnerable dependencies. However, existing metrics fail to capture important nuances, such as considering floating versions and prioritizing recent updates, leading to inaccurate reflections of a development team's update practices. \textit{The goal of this study is to aid practitioners in understanding how quickly packages update their dependencies.} We propose two novel metrics, Mean-Time-To-Update for dependencies (MTTU) and Mean-Time-To-Remediate for vulnerable dependencies (MTTR), that overcome the limitations of existing metrics. We conduct an empirical study using $163,207$ packages in npm ($117,129$), PyPI ($42,777$), and Cargo ($3,301$) and characterize how the ecosystems differ in MTTU and MTTR, as well as what package characteristics influence MTTU and MTTR. We found that most packages have a relatively fast dependency update practice. We further study whether MTTU can be used as a proxy for MTTR when sufficient vulnerability data is not available. As we did not find enough statistical evidence for a strong proxy, our findings suggest that MTTU could only be partially used (may be used but with caution) as a proxy for MTTR when vulnerability data is not available.

翻译：行业从业者日益关注包含易受攻击版本的第三方依赖项（包括直接和传递依赖项）的软件。为解决此问题，项目被鼓励：(a) 快速更新至非易受攻击版本的依赖项，(b) 关注所选用依赖项的更新实践。为此，研究人员提出了衡量包开发团队在保持依赖项更新方面的响应性指标：平均更新耗时（MTTU）和平均修复耗时（MTTR）。MTTU涵盖所有依赖项，而MTTR量化包更新其易受攻击依赖项所需时间。然而，现有指标未能捕捉重要细节，例如考虑浮动版本和优先处理近期更新，导致对开发团队更新实践的不准确反映。\textit{本研究的目的是帮助从业者理解包更新其依赖项的速度。} 我们提出两种新指标——依赖项平均更新耗时（MTTU）和易受攻击依赖项平均修复耗时（MTTR），以克服现有指标的局限性。我们基于npm（117,129个）、PyPI（42,777个）和Cargo（3,301个）中的163,207个包进行实证研究，刻画各生态系统在MTTU和MTTR上的差异，以及影响MTTU和MTTR的包特征。我们发现大多数包具有相对较快的依赖项更新实践。我们进一步研究了当缺乏足够漏洞数据时，MTTU能否作为MTTR的代理指标。由于未找到足够统计学证据支持强代理关系，我们的研究结果表明，在缺乏漏洞数据时，MTTU仅能部分用作MTTR的代理（可谨慎使用）。