Format Online paper / PDF
Location PART 3 - THE THIRD AXIS CHAPTER 15: DEPLOY NOW, PRAY LATER Code as a Coordination Layer

"Many externally maintained dependency updates enter software projects without complete code-review coverage."

Imtiaz and Williams studied dependency updates in the Crates.io, npm, PyPI, and RubyGems ecosystems. Only 9 percent of analyzed packages had all sampled updates fully code-reviewed, providing concrete evidence that software projects routinely incorporate code whose changes have not received comprehensive review.

View Source
Source title Are your dependencies code reviewed? Measuring code review coverage in dependency updates
Source authors Nasif Imtiaz, Laurie Williams
Source year 2022
Confidence high
Importance high
Back to evidence PREVIOUSNEXT