Implicit, Yet Impactful: Understanding Hidden Dependencies in Java Projects
2026-08-17 • Software Engineering
Software Engineering
AI summaryⓘ
The authors studied hidden software package dependencies called implicit dependencies, which are used in projects but not explicitly declared by users. They analyzed a large number of Java libraries from Maven and GitHub and found that about one-third have these hidden dependencies, causing problems like breakages and security risks. The authors identified main reasons for these hidden dependencies and found that many contain vulnerabilities unnoticed by typical security tools. They also proposed ways to better manage and reduce risks related to implicit dependencies.
package managerdependency graphdirect dependencyimplicit dependencytransitive dependencyMavenversion driftsoftware vulnerabilityCVESCA tools
Authors
Lyuye Zhang, Chengwei Liu, Fangyuan Zhang, Yiran Zhang, Yuan Zhou, Yang Liu
Abstract
As software usage continues to expand, package managers automatically resolve dependencies to construct a dependency graph based on user-specified requirements. These explicitly declared dependencies, known as direct dependencies, receive significant attention in terms of maintainability and security. However, implicit dependencies, which are not explicitly defined by users but are still directly utilized or referenced in their project code due to oversight, remain largely unnoticed. Unlike ordinary transitive dependencies, which may remain unused and invisible to the root, implicit dependencies are actively used yet undeclared, leaving their versions outside the project's direct control. This lack of awareness poses substantial challenges related to security and maintainability. In this study, we present the first study to treat implicit dependencies as the focal phenomenon and quantitatively characterize their lifecycle consequences for the Maven ecosystem. We meticulously collected and built a large-scale dataset with 1,157 libraries with 19,812 versions from the Maven Central Repository and 972 modules from GitHub. Our findings reveal that 34.12% of the analyzed dataset contains implicit dependencies, with two primary causes identified as key contributors to the issue. Among these, 48% introduce breaking changes due to version drift, and 36 CVEs have vulnerable methods directly used by root projects; 30.28% of implicit dependencies are affected by known vulnerabilities under the version-range convention SCA tools use for declared dependencies. Finally, we identified and analyzed four major countermeasures, providing actionable insights and practical implications for addressing this overlooked issue for stakeholders within the OSS ecosystem.