Do Developers Update Their Library Dependencies?
https://arxiv.org/abs/1709.04621
Method
"we performed a large-scale empirical study to track library migrations between an application client (defined as a system) and their dependent library provider (defined as a library)."
Population
"The study encompasses 4,659 projects, 8 case studies and a developer survey"
What it does not show
Outdatedness is measured at the manifest level, not the call graph, so it does not establish reachability. The awareness figure comes from a self-selected subset of respondents. Data collection predates the dominance of update bots, so it does not reflect current norms.
Raula Gaikovina Kula, Daniel M. German, Ali Ouni, Takashi Ishio, Katsuro Inoue
81.5% of systems keep their outdated dependencies. In the follow-up survey, 69% of interviewees said they were unaware of the vulnerability in their own dependency, and those who did know often deprioritised migration as extra effort and added responsibility.
Tier II: Large-scale mining of real repositories with a follow-up developer survey. Observational, no control group; the awareness figure is self-reported by a self-selected subset.