Problem definition: For software products, a significant quality concern is security vulnerabilities in external software components that offer pre-built functionalities (i.e., dependencies). If a dependency with a vulnerability (i.e., vulnerable dependency) is exploited by hackers, it can compromise and cause operational disruptions for all downstream software products relying on it. To ensure the quality and security of their software products, developers must promptly resolve each vulnerable dependency that their software uses (e.g., by updating the vulnerable version to a safe version). One promising strategy to expedite this process is automation. We investigate how the adoption of an automated dependency management tool called Dependabot improves the resolution speed of vulnerable dependencies. Methodology/results: Through the analysis of 1,963,957 JavaScript open-source software packages, we identified 476,738 instances of vulnerable dependencies. Our findings from survival analysis models reveal that packages adopting Dependabot exhibit a 2.499 times higher resolution hazard and, thus, are 60% faster at resolving vulnerable dependencies. However, automation may not be a panacea for addressing defective software components. Surprisingly, even among Dependabot adopters, vulnerable dependencies are not addressed immediately, with the median resolution time being 82 days. We unpack why automation's benefits are bounded in this context and show that, while Dependabot mitigates attention-related constraints by re-engaging developers with stale or inactive packages, delays can persist due to human-driven constraints, such as slow processing of proposed code modifications and complexity of verifying compatibility with other components. Managerial implications: Our results shed light on how automation can be harnessed to better safeguard the quality of external components in software products and provide guidance for overcoming technical and human impediments that limit its impact.

Platform owners employ strategic promotions (e.g., platform-initiated penetration pricing) to enlarge their customer base. Under the conventional price-driven economic logic, such promotions are expected to divert demand for the identical goods away from competing platforms, as extensively documented in the conventional brick-and-mortar store context. However, they can also boost the demand. In environments where customers can easily access the identical goods on competing platforms, the increased awareness by strategic promotion, coupled with other non-price factors, can stimulate the purchases of such goods on competing platforms. As such, the effect of strategic promotions on competitive dynamics remains unclear despite their importance for platforms and today’s intensifying platform competition. We utilize the context of online PC game marketplaces where Steam and Epic Games Store dominate. Using the synthetic control approach, our analysis finds that the strategic promotion by Epic Games Store, which offers selected games for free for a week, rather increases the sales of the identical games on Steam substantially (by 59.2%) during that week. In essence, although consumers could obtain the games for free on the promoting platform, more consumers purchased the identical games on the competing platform than before. To comprehensively understand the drivers and conditions of this phenomenon, we perform complementary analysis based on the Attention-Interest-Desire-Action framework, following the progression of consumers’ cross-platform purchase decision process. Using consumer survey and product review data, along with the decomposition of the treatment effect, our results suggest that the effect is more prominent when the price gap between platforms is small and externalities between users or between goods offered by Steam are high. Taken together, our study unveils a unique aspect of strategic promotion in the context of platform competition and highlights the crucial role of externalities in shaping the competitive landscape of digital platforms.