English(EN) Which Is Better For Reducing Outdated and Vulnerable Dependencies: Pinning or Floating?

研究：浮动依赖项可减少过时，但会增加漏洞风险

作者 PulseAugur 编辑部 · [1 个来源] · 2026-05-26 04:00

一项发表在arXiv上的新研究调查了软件开发中固定和浮动依赖项版本之间的权衡。研究人员分析了npm、PyPI和Cargo生态系统的趋势，以确定不同类型的版本约束如何影响依赖项过时或易受攻击的可能性。研究结果表明，虽然固定版本可以防止供应链攻击，但它通常会导致依赖项过时。浮动次要版本被发现是过时和易受攻击依赖项最常见的约束类型，而浮动主版本最不可能导致依赖项过时。 AI

影响不适用

排序理由在arXiv上发表的学术论文，详细介绍了软件依赖项管理策略的实证评估。[lever_c_demoted from research: ic=1 ai=0.1]

在 arXiv cs.LG 阅读 →

AI 生成摘要 · Google Gemini · 来自 1 个来源。我们如何撰写摘要 →

本文如何被排名

Signal score: 0 / 100; Composite score across the factors below. Higher = stronger signal that this story matters right now.
Newsworthiness bucket: Tool; 在arXiv上发表的学术论文，详细介绍了软件依赖项管理策略的实证评估。[lever_c_demoted from research: ic=1 ai=0.1]
Source corroboration: Single-source cluster; Only one publisher covered this so far. Single-source stories can still rank when the publisher is high-authority, but they lack cross-source corroboration.
Topics: paper, other; Editorial topic classification. Feeds into how the story surfaces on /topic/<slug> hub pages and into the per-entity coverage mix.
AI-industry relevance: Low; Off-topic or adjacent — cluster remains reachable but doesn't surface in AI-industry rankings.
Story freshness: 135 days old; Aged out of breaking-news scoring windows; ranking reflects the durable signal from the full source set.

完整方法见我们的编辑标准。

报道来源 [1]

arXiv cs.LG TIER_1 English(EN) · Imranur Rahman, Jill Marley, William Enck, Laurie Williams · 2026-05-26 04:00

减少过时和易受攻击的依赖项：固定版本还是浮动版本哪个更好？

arXiv:2510.08609v3 Announce Type: replace-cross Abstract: Developers consistently use version constraints to specify acceptable versions of the dependencies for their project. Pinning dependencies can reduce the likelihood of breaking changes, but comes with a cost of manually ma…

本文如何被排名

报道来源 [1]

减少过时和易受攻击的依赖项：固定版本还是浮动版本哪个更好？

相关实体

相关话题