A Longitudinal Study of Dependency Reclassifications in JavaScript Projects

• URL: http://arxiv.org/abs/2604.08747v1
• Date: Thu, 09 Apr 2026 20:23:38 GMT
• Title: A Longitudinal Study of Dependency Reclassifications in JavaScript Projects
• Abstract summary: We investigate how developers of JavaScript projects reclassify their dependencies.<n>Our analysis of 33,087 JavaScript projects with active dependency maintenance reveals that dependency reclassification is a prevalent maintenance activity.
• Score: 6.082196277201278
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Modern software projects depend on third-party dependencies, whose declarations must be maintained as projects evolve. Prior work has focused on dependency version updates, while much less is known about how developers assign dependencies to different roles over time. In this paper, we investigate how developers of JavaScript projects reclassify their dependencies, including removal and role reassignment. Our analysis of 33,087 JavaScript projects with active dependency maintenance reveals that dependency reclassification is a prevalent maintenance activity, occurring in 79.1% of the studied projects. Of these projects, nearly all (97.2%) remove dependencies at some point, while 38.0% undergo role reassignments across Core (runtime), Dev (development-only), and Peer (consumer-provided) roles. These changes are not always final, as 33.1% of projects later reintroduce removed dependencies and 11.2% exhibit repeated role switching. Reclassification practices also tend to unfold over long periods, with a median duration of 408 days. These findings broaden the study of dependency maintenance beyond version updates, and contribute implications for dependency tools, package managers, and research to support correct dependency role declarations.

Related papers

• Update from Hell: Can Coding Agents Survive Hidden Breakage in Dependency Upgrades? [46.693059419882694]
  DEPBENCH is a benchmark consisting of 203 real-world dependency-upgrade tasks across five package ecosystems.<n>We evaluate mainstream coding agents on DEPBENCH, highlighting an important gap between current agent capabilities and real-world software maintenance needs.
  arXiv  Detail & Related papers  (2026-08-31T06:13:51Z)
• Implicit, Yet Impactful: Understanding Hidden Dependencies in Java Projects [23.251474006823656]
  We study the first study to treat implicit dependencies as the focal phenomenon and quantitatively characterize their lifecycle consequences for the Maven ecosystem.<n>Our findings reveal that 34.12% of the analyzed dataset contains implicit dependencies, with two primary causes identified as key contributors to the issue.
  arXiv  Detail & Related papers  (2026-08-17T08:33:37Z)
• RepoMirage: Probing Repository Context Reasoning in Code Agents with Perturbations [51.43574078961796]
  We introduce RepoMirage, a two-stage evaluation suite built on SWE-Bench Verified.<n>RepoMirage-Perturb applies three types of semantics-preserving repository-level perturbations, revealing a clear performance drop when correct solving requires broader context access.<n>We propose RepoAnchor, a structure-first prototype workflow that separates repository exploration from downstream problem solving.
  arXiv  Detail & Related papers  (2026-05-25T06:26:43Z)
• Why Authors and Maintainers Link (or Don't Link) Their PyPI Libraries to Code Repositories and Donation Platforms [83.16077040470975]
  Metadata of libraries on the Python Package Index (PyPI) plays a critical role in supporting the transparency, trust, and sustainability of open-source libraries.<n>This paper presents a large-scale empirical study combining two targeted surveys sent to 50,000 PyPI authors and maintainers.<n>We analyze more than 1,400 responses using large language model (LLM)-based topic modeling to uncover key motivations and barriers related to linking repositories and donation platforms.
  arXiv  Detail & Related papers  (2026-01-21T16:13:57Z)
• Analyzing the Availability of E-Mail Addresses for PyPI Libraries [89.21869606965578]
  81.6% of libraries include at least one valid e-mail address, with PyPI serving as the primary source.<n>We identify over 698,000 invalid entries, primarily due to missing fields.
  arXiv  Detail & Related papers  (2026-01-20T14:54:58Z)
• AI-Generated Code Is Not Reproducible (Yet): An Empirical Study of Dependency Gaps in LLM-Based Coding Agents [3.0684671771686394]
  This paper presents an empirical study investigating whether Large Language Models (LLMs) can be executed successfully in a clean environment with only OS packages.<n>We evaluate three state-of-the-art LLM coding agents across 300 projects generated from 100 standardized prompts in Python, JavaScript, and Java.<n>Our results show that only 68.3% of projects execute out-of-the-box, with substantial variation across languages.
  arXiv  Detail & Related papers  (2025-12-26T21:17:22Z)
• Exploring the SECURITY.md in the Dependency Chain: Preliminary Analysis of the PyPI Ecosystem [3.202418533433693]
  Security policies, such as SECURITY.md files, are now common in open-source projects.<n>This study explores the relationship between security policies and dependency management in PyPI projects.
  arXiv  Detail & Related papers  (2025-11-27T07:51:48Z)
• A Preliminary Study on Self-Contained Libraries in the NPM Ecosystem [2.221643499902673]
  The widespread of libraries within modern software ecosystems creates complex networks of dependencies. One mitigation strategy involves reducing dependencies; libraries with zero dependencies become to self-contained. This paper explores the characteristics of self-contained libraries within the NPM ecosystem.
  arXiv  Detail & Related papers  (2024-06-17T09:33:49Z)
• See to Believe: Using Visualization To Motivate Updating Third-party Dependencies [1.7914660044009358]
  Security vulnerabilities introduced by applications using third-party dependencies are on the increase. Developers are wary of library updates, even to fix vulnerabilities, citing that being unaware, or that the migration effort to update outweighs the decision. In this paper, we hypothesize that the dependency graph visualization (DGV) approach will motivate developers to update.
  arXiv  Detail & Related papers  (2024-05-15T03:57:27Z)
• Analyzing Maintenance Activities of Software Libraries [55.2480439325792]
  Industrial applications heavily integrate open-source software libraries nowadays.<n>I want to introduce an automatic monitoring approach for industrial applications to identify open-source dependencies that show negative signs regarding their current or future maintenance activities.
  arXiv  Detail & Related papers  (2023-06-09T16:51:25Z)
• Automatic Specialization of Third-Party Java Dependencies [3.7973152331947815]
  Large-scale code reuse significantly reduces both development costs and time. Massive share of third-party code in software projects poses new challenges, especially in terms of maintenance and security. We propose a novel technique to specialize dependencies of Java projects, based on their actual usage.
  arXiv  Detail & Related papers  (2023-02-16T15:37:49Z)
• Modeling Multi-Label Action Dependencies for Temporal Action Localization [53.53490517832068]
  Real-world videos contain many complex actions with inherent relationships between action classes. We propose an attention-based architecture that models these action relationships for the task of temporal action localization in unoccurrence videos. We show improved performance over state-of-the-art methods on multi-label action localization benchmarks.
  arXiv  Detail & Related papers  (2021-03-04T13:37:28Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.