No file available
To read the file of this research,
you can request a copy directly from the authors.
The Maven Dependency Graph: a Temporal Graph-based Representation of Maven Central
Preprints and early-stage research may not have been peer reviewed yet.
Abstract
The Maven Central Repository provides an extraordinary source of data to understand complex architecture and evolution phenomena among Java applications. As of September 6, 2018, this repository includes 2.8M artifacts (compiled piece of code implemented in a JVM-based language), each of which is characterized with metadata such as exact version, date of upload and list of dependencies towards other artifacts. Today, one who wants to analyze the complete ecosystem of Maven artifacts and their dependencies faces two key challenges: (i) this is a huge data set; and (ii) dependency relationships among artifacts are not modeled explicitly and cannot be queried. In this paper, we present the Maven Dependency Graph. This open source data set provides two contributions: a snapshot of the whole Maven Central taken on September 6, 2018, stored in a graph database in which we explicitly model all dependencies; an open source infrastructure to query this huge dataset.
ResearchGate has not been able to resolve any citations for this publication.
Background: Vulnerable dependencies are a known problem in today's open-source software ecosystems because OSS libraries are highly interconnected and developers do not always update their dependencies.
Aim: Our paper addresses the over-inflation problem of academic and industrial approaches for reporting vulnerable dependencies in OSS software, and therefore, caters to the needs of industrial practice for correct allocation of development and audit resources.
Method: Careful analysis of deployed dependencies, aggregation of dependencies by their projects, and distinction of halted dependencies allow us to obtain a counting method that avoids over-inflation. To understand the industrial impact of a more precise approach, we considered the 200 most popular OSS Java libraries used by SAP in its own software. Our analysis included 10905 distinct GAVs (group, artifact, version) in Maven when considering all the library versions.
Results: We found that about 20% of the dependencies affected by a known vulnerability are not deployed, and therefore, they do not represent a danger to the analyzed library because they cannot be exploited in practice. Developers of the analyzed libraries are able to fix (and actually responsible for) 82% of the deployed vulnerable dependencies. The vast majority (81%) of vulnerable dependencies may be fixed by simply updating to a new version, while 1% of the vulnerable dependencies in our sample are halted, and therefore, potentially require a costly mitigation strategy.
Conclusions: Our case study shows that the correct counting allows software development companies to receive actionable information about their library dependencies, and therefore, correctly allocate costly development and audit resources, which is spent inefficiently in case of distorted measurements.
The term ‘crowdsourcing’ was initially introduced in 2006 to describe an emerging distributed problem-solving model by online workers. Since then it has been widely studied and practiced to support software engineering. In this paper we provide a comprehensive survey of the use of crowdsourcing in software engineering, seeking to cover all literature on this topic. We first review the definitions of crowdsourcing and derive our definition of Crowdsourcing Software Engineering together with its taxonomy. Then we summarise industrial crowdsourcing practice in software engineering and corresponding case studies. We further analyse the software engineering domains, tasks and applications for crowdsourcing and the platforms and stakeholders involved in realising Crowdsourced Software Engineering solutions. We conclude by exposing trends, open issues and opportunities for future research on Crowdsourced Software Engineering.
We present the Maven Dependency Dataset (MDD), containing metrics, changes and dependencies of 148,253 jar files. Metrics and changes have been calculated at the level of individual methods, classes and packages of multiple library versions. A complete call graph is also presented which includes call, inheritance, containment and historical relationships between all units of the entire repository. In this paper, we describe our dataset and the methodology used to obtain it. We present different conceptual views of MDD and we also describe limitations and data quality issues that researchers using this data should be aware of.
Maven-miner procedures
- Inria
Inria. Maven-miner procedures, 2018. [Online]. Available: https://github.
com/diverse-project/maven-miner/wiki/Maven-Miner-Procedures. [Accessed: 13-Nov-2018].
Mining trends of library usage
- Valentin Yana Momchilova Mileva
- Martin Dallmeier
- Andreas Burger
- Zeller
Yana Momchilova Mileva, Valentin Dallmeier, Martin Burger, and
Andreas Zeller. Mining trends of library usage. In Proceedings of
the Joint International and Annual ERCIM Workshops on Principles of
Software Evolution (IWPSE) and Software Evolution (Evol) Workshops,
IWPSE-Evol '09, pages 57-62, New York, NY, USA, 2009. ACM.
- Coen Raula Gaikovina Kula
- De Roover
- M Daniel
- Takashi German
- Katsuro Ishio
- Inoue
Raula Gaikovina Kula, Coen De Roover, Daniel M German, Takashi
Ishio, and Katsuro Inoue. Modeling library dependencies and updates
in large software repository universes. arXiv preprint arXiv:1709.04626,
2017.
Sonatype releases 2016 state of the software supply chain report
- Sonatype
Sonatype.
Sonatype releases 2016 state of the software supply
chain report, 2018. [Online]. Available: https://www.sonatype.com/
press-release-blog/ssc-press-release. [Accessed: 13-Nov-2018].