Time Constraints and Complexity Managing Dependency Security Updates

Many packages depend on OpenSSL indirectly, and a small version drift can cause hours of debugging. Static linking avoids some problems but introduces its own—file size bloat, lack of security updates, and the risk of distributing outdated cryptography.

PHP Dependency Management (26% and tied with Hiring) – which all directly link to PHP maintenance work. Repeated write-in answers included dependency management, unmaintained or un-updated libraries, debugging, and addressing deprecations between PHP versions.

Complex dependency management across multiple repositories, unpredictable build times, inconsistent environment configurations, and difficulty in prioritizing critical deployments

Across all programming languages, dependencies are months behind their latest major update. And those that are less frequently deployed are more likely to be using out-of-date libraries—dependencies in services that are deployed less than once a month are 47% more outdated than those deployed daily.

Time constraints are the most frequently cited barrier to secure package development, with other challenges including difficulties in keeping up with security updates and managing dependencies.