The management of third-party package dependencies is crucial to most technology stacks, with package managers acting as brokers to ensure that a verified package is correctly installed, configured, or removed from an application. Diversity in technology stacks has led to dozens of package ecosystems with their own management features. While recent studies have shown that developers struggle to migrate their dependencies, the common assumption is that package ecosystems are used without any issue. In this study, we explore 13 package ecosystems to understand whether their features correlate with the experience of their users. By studying experience through the questions that developers ask on the question-and-answer site Stack Overflow, we find that developer questions are grouped into three themes (i.e., Package management, Input-Output, and Package Usage). Our preliminary analysis indicates that specific features are correlated with the user experience. Our work lays out future directions to investigate the trade-offs involved in designing the ideal package ecosystem.
Towards Understanding Third-party Library Dependency in C/C++ Ecosystem
第三方库（TPL）经常在软件中重用，以降低开发成本和上市时间。但是，外部库依赖性可能会在主机应用程序中引入漏洞。图书馆的依赖性问题已经引起了相当大的关注。许多包管理器，如Maven，Pip和NPM，被提议用于管理TPL。此外，大量的努力已经投入到研究语言生态系统中的依赖关系，如Java，Python和JavaScript（C/C++除外）。由于缺乏统一的C/C++包管理器，现有的研究对C/C++生态系统中的TPL依赖了解甚少，特别是在大规模的情况下。为了深入理解C/C++生态系统中的TPL依赖，本文收集了现有的TPL数据库、包管理工具和依赖检测工具，总结了C/C++项目的依赖模式，构建了一个全面而精确的C/C++依赖检测器。使用我们的检测器，我们从GitHub上包含24 K C/C++存储库的大型数据库中提取依赖关系。基于提取的依赖关系，我们提供了实证研究的结果和发现，其目的是了解第三方物流的依赖关系的特点。我们进一步讨论了C/C++依赖管理的意义以及未来软件工程研究人员和开发人员在库开发、软件组合分析和C/C++包管理等领域的研究方向。
Empirical Evaluation of AI-Assisted Software Package Selection: A Knowledge Graph Approach
Computer Science, Utrecht University, Utrecht, The Netherlands Michel Chaudron Department of Mathematics；Computer Science, TU Eindhoven, Eindhoven, The Netherlands
Cross-Ecosystem Vulnerability Analysis for Python Applications
University of Athens（雅典大学）；National Infrastructures for Research and Technology（国家研究与技术基础设施）；Athens University of Economics and Business（雅典经济与商业大学）；ETH Zurich（苏黎世联邦理工学院）；Technical University of Crete（克里特理工大学）
A large-scale dataset of Android applications and their SDK dependencies
IMT School for Advanced Studies（高等研究学院）；Istituto Nazionale di Alta Matematica ‘Francesco Severi’ (INdAM-GNAMPA)（高等数学国家研究所‘弗朗切斯科·塞韦里’）；IUSS University School for Advanced Studies（高级研究大学学院）
