Powered by OpenAIRE graph
Found an issue? Give us feedback
image/svg+xml art designer at PLoS, modified by Wikipedia users Nina, Beao, JakobVoss, and AnonMoos Open Access logo, converted into svg, designed by PLoS. This version with transparent background. http://commons.wikimedia.org/wiki/File:Open_Access_logo_PLoS_white.svg art designer at PLoS, modified by Wikipedia users Nina, Beao, JakobVoss, and AnonMoos http://www.plos.org/ ZENODOarrow_drop_down
image/svg+xml art designer at PLoS, modified by Wikipedia users Nina, Beao, JakobVoss, and AnonMoos Open Access logo, converted into svg, designed by PLoS. This version with transparent background. http://commons.wikimedia.org/wiki/File:Open_Access_logo_PLoS_white.svg art designer at PLoS, modified by Wikipedia users Nina, Beao, JakobVoss, and AnonMoos http://www.plos.org/
ZENODO
Dataset . 2024
License: CC BY
Data sources: ZENODO
image/svg+xml art designer at PLoS, modified by Wikipedia users Nina, Beao, JakobVoss, and AnonMoos Open Access logo, converted into svg, designed by PLoS. This version with transparent background. http://commons.wikimedia.org/wiki/File:Open_Access_logo_PLoS_white.svg art designer at PLoS, modified by Wikipedia users Nina, Beao, JakobVoss, and AnonMoos http://www.plos.org/
ZENODO
Dataset . 2024
License: CC BY
Data sources: ZENODO
image/svg+xml Jakob Voss, based on art designer at PLoS, modified by Wikipedia users Nina and Beao Closed Access logo, derived from PLoS Open Access logo. This version with transparent background. http://commons.wikimedia.org/wiki/File:Closed_Access_logo_transparent.svg Jakob Voss, based on art designer at PLoS, modified by Wikipedia users Nina and Beao
Lunaris
Dataset . 2024
License: CC BY
Data sources: Lunaris
ZENODO
Dataset . 2024
License: CC BY
Data sources: Datacite
ZENODO
Dataset . 2024
License: CC BY
Data sources: Datacite
ZENODO
Dataset . 2024
License: CC BY
Data sources: Datacite
versions View all 4 versions
addClaim

Dependabot and Security Pull Requests

Authors: REBATCHI, Hocine;

Dependabot and Security Pull Requests

Abstract

This deposit contains four (4) main datasets that were used in the study "Dependabot and Security Pull Requests: Large Empirical Study" (Link). Each dataset is described as follows : Dataset (1) - Dependency Update : This dataset concerns issues related to pull requests (PRs) that were created by both users and bots to manage dependency updates in GitHub projects. The search was based on the keywords "Dependency, Update" in the title, body or comment of a PR created in the time period between 26/05/2017 and 15/06/2021 for the 1st partition, and between 01/01/2023 and 30/09/2023 for the 2nd partition. We obtained a total of 6,573,489 PR-related issues belonging to a total of 927,007 repositories for partition (1); and for partition (2), we obtained a total of 3,342,829 PR-related issues belonging to a total of 816,028 repositories. Dataset (2) - Dependabot Security PRs : The second dataset is related to PRs created by Dependabot to handle security vulnerabilities in project dependencies. In our search, we look for PR-related issues created by "Dependabot-preview" or "Dependabot" and with the label "security", also created during the time period between 26/05/2017 and 30/09/2023. With these parameters, our results consist of 422,388 issues from 47,987 repositories. Dataset (3) - Manual Security PRs : For this dataset, we were interested in PRs created only by users to handle security vulnerabilities. The search consists of finding the keywords "Dependency, Vulnerable" in the title, body or comment of a PR created in the time period between 26/05/2017 and 30/09/2023. We only consider pull requests created by authors with the type "user". The final results include a total of 186,186 issues for 60,758 repositories. Dataset (4) - Bots' Security PRs : This dataset is related to PRs created by several bots to handle security vulnerabilities in project dependencies. In the search query, we look for PR-related issues where the keywords "Dependency", and "Security", and "Vulnerability" are mentioned in the title, body, or comment of the PR. These PRs are created by one of the following bots: "Snyk", "Renovate", "Greenkeeper", or "Depfu", also created during the time period between 26/05/2017 and 30/09/2023. The obtained results for the 4 bots consists of a collection of 628,495 PR-related issues in a total of 105,342 repositories. We also included : Derived Sample : This sample contains the data that was selected and extracted to conduct our manual qualitative analysis, and the manual feature extraction.

Country
Canada
Keywords

GitHub, Dependabot, Software Supply Chain, Dependency, Software Vulnerability, Pull Request

  • BIP!
    Impact byBIP!
    selected citations
    These citations are derived from selected sources.
    This is an alternative to the "Influence" indicator, which also reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically).
    0
    popularity
    This indicator reflects the "current" impact/attention (the "hype") of an article in the research community at large, based on the underlying citation network.
    Average
    influence
    This indicator reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically).
    Average
    impulse
    This indicator reflects the initial momentum of an article directly after its publication, based on the underlying citation network.
    Average
    OpenAIRE UsageCounts
    Usage byUsageCounts
    visibility views 2
  • 2
    views
    Powered byOpenAIRE UsageCounts
Powered by OpenAIRE graph
Found an issue? Give us feedback
visibility
selected citations
These citations are derived from selected sources.
This is an alternative to the "Influence" indicator, which also reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically).
BIP!Citations provided by BIP!
popularity
This indicator reflects the "current" impact/attention (the "hype") of an article in the research community at large, based on the underlying citation network.
BIP!Popularity provided by BIP!
influence
This indicator reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically).
BIP!Influence provided by BIP!
impulse
This indicator reflects the initial momentum of an article directly after its publication, based on the underlying citation network.
BIP!Impulse provided by BIP!
views
OpenAIRE UsageCountsViews provided by UsageCounts
0
Average
Average
Average
2