CHRONO-RESOLUTION: A Dependency Resolution Dataset at Release Points for npm, PyPI, and crates.io Packages

• URL: http://arxiv.org/abs/2607.15315v1
• Date: Wed, 15 Jul 2026 23:02:20 GMT
• Title: CHRONO-RESOLUTION: A Dependency Resolution Dataset at Release Points for npm, PyPI, and crates.io Packages
• Abstract summary: We present a methodology to construct dependency resolution at release points of packages in software ecosystems.<n>We apply our methodology to construct CHRONO-RESOLUTION, a dataset of dependency resolution at release points for npm, PyPI, and crates.io packages.
• Score: 0.71747343065587
• License: http://creativecommons.org/licenses/by-nc-nd/4.0/
• Abstract: Dependency resolution at a specified point in time in the past can provide insight into software evolution in software ecosystems and facilitate the design of dynamic metrics (e.g., dependency freshness, dependency update rhythm). However, dependency resolution at specified points in time is not possible in major software ecosystems due to a lack of support from package management tools. The goal of this paper is to aid practitioners and researchers in analyzing the state of the ecosystem dependency graph at release points using an enriched dataset with dependency resolution at release points for npm, PyPI, and crates.io packages. In this paper, we present a methodology to construct dependency resolution at release points of packages in software ecosystems, which we enrich with vulnerability data from OSV. We apply our methodology to construct CHRONO-RESOLUTION, a dataset of dependency resolution at release points for npm, PyPI, and crates.io packages, and release it for future research.

Related papers

• Modeling Dependency-Propagated Ecosystem Impact of Changes in Maintenance Activities: Evaluating Support Strategies in the PyPI Network [83.16077040470975]
  We introduce a dependency-aware model of ecosystem impact that captures how changes in maintenance activities propagate through the Python Package Index (PyPI) ecosystem.<n>Our results show that a large share of the modeled ecosystem impact can be attributed to just 0.1% of all PyPI packages when prioritized based on dependency-propagated impact.
  arXiv  Detail & Related papers  (2026-05-07T12:51:00Z)
• Autogenesis: A Self-Evolving Agent Protocol [60.15939127351914]
  We introduce Autogenesis Protocol (AGP), a self evolution protocol that decouples what evolves from how evolution occurs.<n>We present Autogenesis System (AGS), a self-evolving multi-agent system that dynamically instantiates, retrieves, and refines protocol-registered resources during execution.
  arXiv  Detail & Related papers  (2026-04-16T14:04:06Z)
• Why Authors and Maintainers Link (or Don't Link) Their PyPI Libraries to Code Repositories and Donation Platforms [83.16077040470975]
  Metadata of libraries on the Python Package Index (PyPI) plays a critical role in supporting the transparency, trust, and sustainability of open-source libraries.<n>This paper presents a large-scale empirical study combining two targeted surveys sent to 50,000 PyPI authors and maintainers.<n>We analyze more than 1,400 responses using large language model (LLM)-based topic modeling to uncover key motivations and barriers related to linking repositories and donation platforms.
  arXiv  Detail & Related papers  (2026-01-21T16:13:57Z)
• Analyzing the Availability of E-Mail Addresses for PyPI Libraries [89.21869606965578]
  81.6% of libraries include at least one valid e-mail address, with PyPI serving as the primary source.<n>We identify over 698,000 invalid entries, primarily due to missing fields.
  arXiv  Detail & Related papers  (2026-01-20T14:54:58Z)
• How Deep Does Your Dependency Tree Go? An Empirical Study of Dependency Amplification Across 10 Package Ecosystems [0.0]
  We study 500 projects across ten major ecosystems, including Maven, npm Registry, RubyGems, Go Modules, PyPI, CocoaPods, and Pub.<n>We find significant differences with large effect sizes in 22 of 45 pairwise comparisons, challenging the assumption that npm has the highest amplification.<n>Our findings suggest adopting ecosystem specific security strategies, including systematic auditing for Maven environments, targeted outlier detection for npm and RubyGems, and continuation of current practices for ecosystems with controlled amplification.
  arXiv  Detail & Related papers  (2025-12-12T05:53:32Z)
• Empirical Evaluation of AI-Assisted Software Package Selection: A Knowledge Graph Approach [4.100870096741918]
  This study formulates software package selection as a Multi-Criteria Decision-Making (MCDM) problem.<n>Data pipelines continuously collect and integrate software metadata, usage trends, vulnerability information, and developer sentiment.<n>System uses large language models to interpret user intent and query the model to identify contextually appropriate packages.
  arXiv  Detail & Related papers  (2025-08-06T13:55:43Z)
• PyPitfall: Dependency Chaos and Software Supply Chain Vulnerabilities in Python [1.2644387713029346]
  This paper introduces PyPitfall, a quantitative analysis of vulnerable dependencies across the PyPI ecosystem.<n>We analyzed the dependency structures of 378,573 PyPI packages and identified 4,655 packages that explicitly require at least one known-vulnerable version.<n>We aim to raise awareness of Python software supply chain security by characterizing the ecosystem-wide dependency landscape.
  arXiv  Detail & Related papers  (2025-07-24T03:58:18Z)
• Insights into Dependency Maintenance Trends in the Maven Ecosystem [0.14999444543328289]
  We present a quantitative analysis of the Neo4j dataset using the Goblin framework.<n>Our analysis reveals that releases with fewer dependencies have a higher number of missed releases.<n>Our study shows that the dependencies in the latest releases have positive freshness scores, indicating better software management efficacy.
  arXiv  Detail & Related papers  (2025-03-28T22:20:24Z)
• Analyzing the Usage of Donation Platforms for PyPI Libraries [91.97201077607862]
  This study analyzes the adoption of donation platforms in the PyPI ecosystem.<n> GitHub Sponsors is the dominant platform, though many PyPI-listed links are outdated.
  arXiv  Detail & Related papers  (2025-03-11T10:27:31Z)
• Towards Sustainable and Secure Reuse in Dependency Supply Chains: Initial Analysis of NPM packages at the End of the Chain [1.7577744940574058]
  We investigate packages with no dependencies themselves that bear the responsibility of being at the end of the dependency supply chain.<n>Our initial analysis of the most depended upon NPM packages shows that such end-of-chain packages make up a significant portion of these critical dependency chain.<n>We argue that these packages reveal important lessons for strategic reuse-balancing the undeniable benefits of dependency ecosystems with sustainable, secure practices.
  arXiv  Detail & Related papers  (2025-03-04T17:26:34Z)
• How Quickly Do Development Teams Update Their Vulnerable Dependencies? [3.5472726784546076]
  Mean-Time-To-Update (MTTU) and Mean-Time-To-Remediate for vulnerable dependencies (MTTR)<n>We propose two novel metrics, Mean-Time-To-Update for dependencies (MTTU) and Mean-Time-To-Remediate for vulnerable dependencies (MTTR)
  arXiv  Detail & Related papers  (2024-03-26T05:01:53Z)
• Less is More? An Empirical Study on Configuration Issues in Python PyPI Ecosystem [38.44692482370243]
  Python is widely used in the open-source community, largely owing to the extensive support from diverse third-party libraries. Third-party libraries can potentially lead to conflicts in dependencies, prompting researchers to develop dependency conflict detectors. endeavors have been made to automatically infer dependencies.
  arXiv  Detail & Related papers  (2023-10-19T09:07:51Z)
• PyHHMM: A Python Library for Heterogeneous Hidden Markov Models [63.01207205641885]
  PyHHMM is an object-oriented Python implementation of Heterogeneous-Hidden Markov Models (HHMMs) PyHHMM emphasizes features not supported in similar available frameworks: a heterogeneous observation model, missing data inference, different model order selection criterias, and semi-supervised training. PyHHMM relies on the numpy, scipy, scikit-learn, and seaborn Python packages, and is distributed under the Apache-2.0 License.
  arXiv  Detail & Related papers  (2022-01-12T07:32:36Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.