Keeping dependencies up-to-date prevents software supply chain attacks through outdated and vulnerable dependencies. Developers may use packages' dependency update practice as one of the selection criteria for choosing a package as a dependency. However, the lack of metrics characterizing packages' dependency update practice makes this assessment difficult. To measure the up-to-date characteristics of packages, we focus on the dependency management aspect and propose two update metrics: Time-Out-Of-Date (TOOD) and Post-Fix-Exposure-Time (PFET), to measure the updatedness of dependencies and updatedness of vulnerable dependencies, respectively. We design an algorithm to stabilize the dependency relationships in different time intervals and compute the proposed metrics for each package. Using our proposed metrics, we conduct a large-scale empirical study of update metrics with 2.9M packages, 66.8M package versions, and 26.8M unique package-dependency relations in NPM, PyPI, and Cargo, ranging from the year 2004 to 2023. We analyze the characteristics of the proposed metrics for capturing packages' dependency update practice in the three ecosystems. Given that the TOOD metric generates a greater volume of data than the PFET metric, we further explore the numerical relationship between these metrics to assess their potential as substitutes for vulnerability counts metrics. We find that PyPI packages update dependencies faster than NPM and Cargo. Conversely, Cargo packages update their vulnerable dependencies faster than NPM and PyPI. We also find that the general purpose update metric, TOOD, can be a proxy for the security-focused update metric, PFET.

翻译：保持依赖项最新可防止软件供应链因过时且易受攻击的依赖项而遭受攻击。开发者可能会将包的依赖更新实践作为选择依赖包的标准之一。然而，由于缺乏表征包依赖更新实践的指标，这一评估变得困难。为衡量包的最新特性，我们聚焦于依赖管理方面，提出两个更新指标：过期时间（Time-Out-Of-Date, TOOD）和后修复暴露时间（Post-Fix-Exposure-Time, PFET），分别用于衡量依赖项的新旧程度和易受攻击依赖项的新旧程度。我们设计了一种算法来稳定不同时间区间内的依赖关系，并为每个包计算所提出的指标。利用所提出的指标，我们对 NPM、PyPI 和 Cargo 中 290 万个包、6680 万个包版本以及 2680 万个唯一的包-依赖关系（时间跨度从 2004 年到 2023 年）进行了大规模更新指标实证研究。我们分析了所提指标在捕捉三个生态系统中包依赖更新实践方面的特性。鉴于 TOOD 指标生成的数据量大于 PFET 指标，我们进一步探讨了这些指标之间的数值关系，以评估它们作为漏洞计数指标替代品的潜力。我们发现，PyPI 包更新依赖项的速度快于 NPM 和 Cargo。相反，Cargo 包更新其易受攻击依赖项的速度快于 NPM 和 PyPI。我们还发现，通用更新指标 TOOD 可作为安全相关更新指标 PFET 的代理指标。