Where does a software update go once it is released?

Follow the connections

These are explicit references between records. The link itself does not establish support or intellectual influence.

Referenced by this record

• New releases arrive quickly. Older versions keep getting downloaded. finding
• Most downloads of old versions come from Pythons a newer version supports finding
• Further down Python's download rankings, fewer libraries' new versions take half the downloads in two days finding
• When a Python project pins a library, the container recipe it keeps mostly installs what the pin names finding
• When a Python project pins a library, its test and build workflows almost always install what the pin names finding
• Public records show where a software update went, but not why, or whether anyone ran it finding
• Downloads show a new release taken up within two days, but not where it was installed or whether anyone ran it finding
• Published images show what software installed, and it was not always what its project had chosen finding
• Software built from open ranges took a new release within days; pinned software waited a month, and moved most often when a security advisory came finding
• Pinned software moved to security fixes over weeks, a little faster after the release and again after the advisory, and neither drew most of the moves finding
• Pinned software moved faster to security fixes that said so in their notes, mostly by people in the days after the release, but no larger share moved before the advisory finding
• Does pinned software move sooner to a security fix that says so? Added up, it leans that way; library by library, we cannot tell finding
• The xz backdoor sat in public for nearly five weeks until a slow login gave it away finding
• We can see pieces of the internet's AI activity, but not how they fit together finding
• When something changes in a small software neighbourhood, where does the change appear next? study
• Can any public record connect a software release to its installation? study
• Is there a public record of what was installed, past the download? study
• When a widely used library releases, how much of the software built on it installs the new version because an installer resolved an open range, and how much waits for a maintainer to move a pin or lockfile? study
• When software built on a widely used library pins or locks it, what moves the pin: a new release, or a security advisory fixed by one? study
• When a fixed release says in its own notes that it fixes a security flaw, do pinned dependents move to it before the advisory is published, more than they move to a fix released silently? study
• Do pinned dependents move faster before the advisory to fixes whose notes announce a security flaw than to silent ones, when each class has enough libraries that no one or two carry the result? study
• Where does a software update go? investigation

Records that refer back here

• Where does a software update go? investigation
• Most downloads of old versions come from Pythons a newer version supports finding
• Further down Python's download rankings, fewer libraries' new versions take half the downloads in two days finding
• When a Python project pins a library, the container recipe it keeps mostly installs what the pin names finding
• When a Python project pins a library, its test and build workflows almost always install what the pin names finding
• Does pinned software move sooner to a security fix that says so? Added up, it leans that way; library by library, we cannot tell finding
• New releases arrive quickly. Older versions keep getting downloaded. finding
• What the watch would see of a pattern that copies itself essay