Record available
When software built on a widely used library pins or locks it, what moves the pin: a new release, or a security advisory fixed by one?
The question
What moves a dependent’s pin: a new release or a security advisory?
What the record says
Across four libraries, 73 of 102 repository and library pairs moved to a fix or later, at a median 18.7 days after release. Moves rose after both releases and advisories; each two-day window contained eight moves, which cannot show which the advisory caused.
Follow the connections
These are explicit references between records. The link itself does not establish support or intellectual influence.
Records that refer back here
- Where does a software update go? investigation
- Pinned software moved faster to security fixes that said so in their notes, mostly by people in the days after the release, but no larger share moved before the advisory finding
- Pinned software moved to security fixes over weeks, a little faster after the release and again after the advisory, and neither drew most of the moves finding
- Where does a software update go once it is released? finding
- Seen from outside, seen from inside essay
Navigation summary checked against the retained record. A record being written does not by itself mean that its study or investigation has ended.