  Security vulnerabilities introduced by applications using third-party
dependencies are on the increase, caused by the emergence of large ecosystems
of libraries such as the NPM packages for JavaScript. Nowadays, libraries
depend on each other. Relying on these large ecosystems thus means that
vulnerable dependencies are not only direct but also indirect (transitive)
dependencies. There are automated tool supports to manage these complex
dependencies but recent work still shows that developers are wary of library
updates, even to fix vulnerabilities, citing that being unaware, or that the
migration effort to update outweighs the decision.
  In this paper, we hypothesize that the dependency graph visualization (DGV)
approach will motivate developers to update, especially when convincing
developers. To test this hypothesis, we performed a user study involving 20
participants divided equally into experimental and control groups, comparing
the state-of-the-art tools with the tasks of reviewing vulnerabilities with
complexities and vulnerabilities with indirect dependencies.
  We find that 70% of the participants who saw the visualization did
re-prioritize their updates in both tasks. This is higher than the 30% and 60%
of the participants who used the npm audit tool in both tasks, respectively.
