AI 中文总结
本文旨在借助丰富数据集助从业者和研究者分析软件包发布点的生态系统依赖图，提出构建软件生态系统包发布点依赖项解析的方法，融入漏洞数据构建CHRONO-RESOLUTION数据集并发布，以推动相关研究。
AI 中文摘要
过去特定时间点的依赖项解析有助于洞察软件生态系统中的软件演化并推动动态指标设计。但由于包管理工具缺乏支持，主要软件生态系统中无法进行特定时间点的依赖项解析。本文旨在通过丰富数据集帮助从业者和研究人员分析发布点的生态系统依赖图。提出构建软件生态系统包发布点依赖项解析的方法，并融入OSV漏洞数据，构建了CHRONO-RESOLUTION数据集并发布供未来研究。
英文摘要
Dependency resolution at a specified point in time in the past can provide insight into software evolution in software ecosystems and facilitate the design of dynamic metrics (e.g., dependency freshness, dependency update rhythm). However, dependency resolution at specified points in time is not possible in major software ecosystems due to a lack of support from package management tools. The goal of this paper is to aid practitioners and researchers in analyzing the state of the ecosystem dependency graph at release points using an enriched dataset with dependency resolution at release points for npm, PyPI, and crates.io packages. In this paper, we present a methodology to construct dependency resolution at release points of packages in software ecosystems, which we enrich with vulnerability data from OSV. We apply our methodology to construct CHRONO-RESOLUTION, a dataset of dependency resolution at release points for npm, PyPI, and crates.io packages, and release it for future research.
CommentsAccepted to ICSME 2026 in the Tool Demonstration and Data Showcase Track
Journal ref42nd International Conference on Software Maintenance and Evolution (ICSME) 2026
