English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

As modern software extensively uses free open source packages asdependencies, developers have to regularly pull in new third-party code throughfrequent updates. However, without a proper review of every incoming change,vulnerable and malicious code can sneak into the codebase through thesedependencies. The goal of this study is to aid developers in securely acceptingdependency updates by measuring if the code changes in an update have passedthrough a code review process. We implement Depdive, an update audit tool forpackages in Crates.io, npm, PyPI, and RubyGems registry. Depdive first (i)identifies the files and the code changes in an update that cannot be tracedback to the package's source repository, i.e., \textit{phantom artifacts}; andthen (ii) measures what portion of changes in the update, excluding the phantomartifacts, has passed through a code review process, i.e., \textit{code reviewcoverage}.  Using Depdive, we present an empirical study across the latest ten updates ofthe most downloaded 1000 packages in each of the four registries. We furtherevaluated our results through a maintainer agreement survey. We find theupdates are typically only partially code-reviewed (52.5\% of the time).Further, only 9.0\% of the packages had all their updates in our data set fullycode-reviewed, indicating that even the most used packages can introducenon-reviewed code in the software supply chain. We also observe that updateseither tend to have high \textit{CRC} or low \textit{CRC}, suggesting thatpackages at the opposite end of the spectrum may require a separate set oftreatments.

Are your dependencies code reviewed?: Measuring code review coverage in dependency updates