Search papers, labs, and topics across Lattice.
This study quantitatively investigates implicit dependencies in Java projects, revealing that 34.12% of analyzed libraries contain these hidden dependencies, which are actively used but not explicitly declared. The research identifies two primary causes for these implicit dependencies: version drift leading to breaking changes and the presence of vulnerabilities in methods directly utilized by root projects. By analyzing a large-scale dataset from the Maven ecosystem, the authors provide actionable insights and countermeasures to mitigate the security and maintainability risks posed by these overlooked dependencies.
Over a third of Java libraries harbor hidden dependencies that can introduce breaking changes and security vulnerabilities, yet remain unnoticed by developers.
As software usage continues to expand, package managers automatically resolve dependencies to construct a dependency graph based on user-specified requirements. These explicitly declared dependencies, known as direct dependencies, receive significant attention in terms of maintainability and security. However, implicit dependencies, which are not explicitly defined by users but are still directly utilized or referenced in their project code due to oversight, remain largely unnoticed. Unlike ordinary transitive dependencies, which may remain unused and invisible to the root, implicit dependencies are actively used yet undeclared, leaving their versions outside the project's direct control. This lack of awareness poses substantial challenges related to security and maintainability. In this study, we present the first study to treat implicit dependencies as the focal phenomenon and quantitatively characterize their lifecycle consequences for the Maven ecosystem. We meticulously collected and built a large-scale dataset with 1,157 libraries with 19,812 versions from the Maven Central Repository and 972 modules from GitHub. Our findings reveal that 34.12% of the analyzed dataset contains implicit dependencies, with two primary causes identified as key contributors to the issue. Among these, 48% introduce breaking changes due to version drift, and 36 CVEs have vulnerable methods directly used by root projects; 30.28% of implicit dependencies are affected by known vulnerabilities under the version-range convention SCA tools use for declared dependencies. Finally, we identified and analyzed four major countermeasures, providing actionable insights and practical implications for addressing this overlooked issue for stakeholders within the OSS ecosystem.
Tsinghua AI