Developers consistently use version constraints to specify acceptable versions of the dependencies for their project. Pinning dependencies can reduce the likelihood of breaking changes, but comes with a cost of manually managing the replacement of outdated and vulnerable dependencies. On the other hand, floating can be used to automatically get bug fixes and security fixes, but comes with the risk of breaking changes. Security practitioners advocate pinning dependencies to prevent against software supply chain attacks, e.g., malicious package updates. However, since pinning is the tightest version constraint, pinning is the most likely to result in outdated dependencies. Nevertheless, how the likelihood of becoming outdated or vulnerable dependencies changes across version constraint types is unknown. The goal of this study is to aid developers in making an informed dependency version constraint choice by empirically evaluating the likelihood of dependencies becoming outdated or vulnerable across version constraint types at scale. In this study, we first identify the trends in dependency version constraint usage and the patterns of version constraint type changes made by developers in the npm, PyPI, and Cargo ecosystems. We then modeled the dependency state transitions using survival analysis and estimated how the likelihood of becoming outdated or vulnerable changes when using pinning as opposed to the rest of the version constraint types. We observe that among outdated and vulnerable dependencies, the most commonly used version constraint type is floating-minor, with pinning being the next most common. We also find that floating-major is the least likely to result in outdated and floating-minor is the least likely to result in vulnerable dependencies.

翻译：开发者始终使用版本约束来指定项目可接受的依赖版本范围。固定依赖可降低破坏性变更的发生概率，但需人工管理过时及存在漏洞的依赖项替换成本；反之，浮动依赖能自动获取缺陷修复与安全更新，却存在引入破坏性变更的风险。安全从业者提倡通过固定依赖防御软件供应链攻击（如恶意软件包更新），但由于固定依赖是最严格的版本约束，最容易导致依赖过时。然而，不同版本约束类型对依赖项过时或存在漏洞的可能性影响尚不明确。本研究旨在通过大规模实证评估不同版本约束类型下依赖项过时或存在漏洞的可能性，辅助开发者做出明智的依赖版本约束选择。我们首先分析了npm、PyPI和Cargo生态系统中依赖版本约束的使用趋势及开发者变更版本约束类型的模式，继而运用生存分析对依赖状态转换进行建模，评估固定依赖相较于其他版本约束类型对依赖项过时或存在漏洞可能性的影响差异。研究发现：在过时或存在漏洞的依赖项中，最常用的版本约束类型为浮动小版本（floating-minor），其次为固定依赖；同时，浮动大版本（floating-major）导致依赖过时的可能性最低，而浮动小版本导致依赖存在漏洞的可能性最低。