Characterising Contributions that Coincide with Vulnerability Mitigation in NPM Libraries
Fuente:
arXiv
Salvato in:
| Autori principali: | , , , , |
|---|---|
| Natura: | Preprint |
| Pubblicazione: |
2024
|
| Soggetti: | |
| Accesso online: | |
| Tags: |
Aggiungi Tag
Nessun Tag, puoi essere il primo ad aggiungerne!!
|
| _version_ | 1866911920422912000 |
|---|---|
| author | Rojpaisarnkit, Ruksit Damrongsiri, Hathaichanok Treude, Christoph Ouni, Ali Kula, Raula Gaikovina |
| author_facet | Rojpaisarnkit, Ruksit Damrongsiri, Hathaichanok Treude, Christoph Ouni, Ali Kula, Raula Gaikovina |
| contents | With the urgent need to secure supply chains among Open Source libraries, attention has focused on mitigating vulnerabilities detected in these libraries. Although awareness has improved recently, most studies still report delays in the mitigation process. This suggests that developers still have to deal with other contributions that occur during the period of fixing vulnerabilities, such as coinciding Pull Requests (PRs) and Issues, yet the impact of these contributions remains unclear. To characterize these contributions, we conducted a mixed-method empirical study to analyze NPM GitHub projects affected by 554 different vulnerability advisories, mining a total of 4,699 coinciding PRs and Issues. We believe that tool development and improved workload management for developers have the potential to create a more efficient and effective vulnerability mitigation process. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2406_11362 |
| institution | arXiv |
| publishDate | 2024 |
| record_format | arxiv |
| spellingShingle | Characterising Contributions that Coincide with Vulnerability Mitigation in NPM Libraries Rojpaisarnkit, Ruksit Damrongsiri, Hathaichanok Treude, Christoph Ouni, Ali Kula, Raula Gaikovina Software Engineering D.2.7; D.2.9 With the urgent need to secure supply chains among Open Source libraries, attention has focused on mitigating vulnerabilities detected in these libraries. Although awareness has improved recently, most studies still report delays in the mitigation process. This suggests that developers still have to deal with other contributions that occur during the period of fixing vulnerabilities, such as coinciding Pull Requests (PRs) and Issues, yet the impact of these contributions remains unclear. To characterize these contributions, we conducted a mixed-method empirical study to analyze NPM GitHub projects affected by 554 different vulnerability advisories, mining a total of 4,699 coinciding PRs and Issues. We believe that tool development and improved workload management for developers have the potential to create a more efficient and effective vulnerability mitigation process. |
| title | Characterising Contributions that Coincide with Vulnerability Mitigation in NPM Libraries |
| topic | Software Engineering D.2.7; D.2.9 |
| url | https://arxiv.org/abs/2406.11362 |