Giving Back: Contributions Congruent to Library Dependency Changes in a Software Ecosystem
The widespread adoption of third-party libraries for contemporary software development has led to the creation of large inter-dependency networks, where sustainability issues of a single library can have widespread network effects. Maintainers of these libraries are often overworked, relying on the contributions of volunteers to sustain these libraries. To understand these contributions, in this work, we leverage socio-technical techniques to introduce and formalise dependency-contribution congruence (DC congruence) at both ecosystem and library level, i.e., to understand the degree and origins of contributions congruent to dependency changes, analyze whether they contribute to library dormancy (i.e., a lack of activity), and investigate similarities between these congruent contributions compared to typical contributions. We conduct a large-scale empirical study to measure the DC congruence for the npm ecosystem using 1.7 million issues, 970 thousand pull requests (PRs), and over 5.3 million commits belonging to 107,242 npm libraries. We find that the most congruent contributions originate from contributors who can only submit (not commit) to both a client and a library. At the project level, we find that DC congruence shares an inverse relationship with the likelihood that a library becomes dormant. Specifically, a library is less likely to become dormant if the contributions are congruent with upgrading dependencies. Finally, by comparing the source code of contributions, we find statistical differences in the file path and added lines in the source code of congruent contributions when compared to typical contributions. Our work has implications to encourage dependency contributions, especially to support library maintainers in sustaining their projects.
Wed 17 MayDisplayed time zone: Hobart change
11:00 - 12:30 | APIs and librariesTechnical Track / Journal-First Papers / SEIP - Software Engineering in Practice at Meeting Room 105 Chair(s): Sarah Nadi University of Alberta | ||
11:00 15mTalk | UpCy: Safely Updating Outdated Dependencies Technical Track Andreas Dann Paderborn University, Ben Hermann TU Dortmund, Eric Bodden Heinz Nixdorf Institut, Paderborn University and Fraunhofer IEM Pre-print | ||
11:15 15mTalk | APICAD: Augmenting API Misuse Detection Through Specifications From Code And Documents Technical Track DOI Pre-print | ||
11:30 15mTalk | Compatibility Issue Detection for Android Apps Based on Path-Sensitive Semantic Analysis Technical Track Sen Yang Army Engineering University of PLA, Sen Chen Tianjin University, Lingling Fan Nankai University, Sihan Xu Nankai University, China, Zhanwei Hui Academy of Military Science, Song Huang Army Engineering University of PLA | ||
11:45 15mTalk | OSSFP: Precise and Scalable C/C++ Third-Party Library Detection using Fingerprinting Functions Technical Track Wu Jiahui Nanyang Technological University, Zhengzi Xu Nanyang Technological University, Wei Tang Tsinghua University, Lyuye Zhang Nanyang Technological University, Yueming Wu Nanyang Technological University, Chengyue Liu Scantist, Kairan Sun Singapore University of Technology and Design, Lida Zhao Nanyang Technological University, Yang Liu Nanyang Technological University | ||
12:00 15mTalk | Scaling Web API Integrations SEIP - Software Engineering in Practice Pre-print | ||
12:15 7mTalk | Giving Back: Contributions Congruent to Library Dependency Changes in a Software Ecosystem Journal-First Papers Supatsara Wattanakriengkrai Nara Institute of Science and Technology, Dong Wang Kyushu University, Japan, Raula Gaikovina Kula Nara Institute of Science and Technology, Christoph Treude University of Melbourne, Patanamon Thongtanunam University of Melbourne, Takashi Ishio Future University Hakodate, Kenichi Matsumoto Nara Institute of Science and Technology Link to publication | ||
12:22 7mTalk | Breaking Bad? Semantic Versioning and Impact of Breaking Changes in Maven Central Journal-First Papers Lina Ochoa Eindhoven University of Technology, Thomas Degueule CNRS, LaBRI, Jean-Rémy Falleri Bordeaux INP, Jurgen Vinju CWI; Eindhoven University of Technology |