Cascading Effects: Analyzing Project Failure Impact in the Maven Central Ecosystem
Mina Shehata, Saidmakhmud Makhkamjonoov, Mahad Syed, Esteban Parra · 2025
This study examines failure propagation within the Maven Central ecosystem, a critical software dependency repository, through a comprehensive analysis of dependency networks using the Goblin framework. Our dual-sampling methodology, investigating both top dependencies and random libraries, revealed two distinct failure propagation patterns that pose significant risks to ecosystem stability. Core infrastructure failures, particularly evident in cases like the AWS SDK family, can create immediate and widespread disruption. These libraries have many direct dependents - averaging 20,402 projects that would break immediately if the library fails. Furthermore, these core libraries themselves have extensive dependencies, with the AWS SDK family depending on 377 other libraries itself. The impact of failures spreads deeply through the ecosystem, with dependency chains reaching an average of 90.80 levels. Our analysis of peripheral projects reveals their significant cascading effects, with higher average dependency depths of 54.25 levels and chain lengths extending to 116.74 levels, as exemplified by cases like org.apache.camel:camel-swagger-java, which demonstrated a maximum chain length of 647 levels. Our findings highlight specific vulnerabilities in dependency network structures, showing that ecosystem resilience requires both protecting core infrastructure and managing dependency complexity.