Nearly all (95%) version upgrades of open source software contain at least one breaking change that causes other components to fail, with patches having a 75% chance of causing a break, according to Endor Labs. The security vendor revealed the findings in its third annual Dependency Management Report, which is based on Endor Labs vulnerability and customer data, information in the Open Source Vulnerabilities (OSV) database and Java ARchives (JARs) related to the top 15 open source dependencies.

Source: Infosecurity