利用群体智慧进行依赖管理：关于 Dependabot 兼容性分数的实证研究
Leveraging the Crowd for Dependency Management: An Empirical Study on the Dependabot Compatibility Score
AI总结：
本研究实证分析 Dependabot 兼容性分数，发现其因数据不足在83%更新中无法计算且多数分数质量低，提出放大群体输入及个性化指标以预测更新接受，建议机器人提供置信区间并关注测试质量。
摘要：
Dependabot 是一款流行的依赖管理工具，其包含一项兼容性分数功能，通过利用“群体”的知识帮助客户端包评估接受依赖更新的风险。对于每次依赖更新，Dependabot 将兼容性分数计算为使用同一提供方包作为依赖的其他客户端包所执行的成功更新的比例。在本文中，我们研究了兼容性分数在帮助客户端包评估接受依赖更新所涉及风险方面的有效性。我们分析了 Dependabot 为更新依赖而开启的 579,206 个拉取请求，以及 Dependabot 计算的 618,045 条兼容性分数记录。我们发现，由于缺乏来自群体的数据，83% 的依赖更新无法计算兼容性分数。然而，绝大多数可计算的分数具有较小的置信区间，且基于低质量数据，这表明客户端包应有额外角度来评估更新的风险以及兼容性分数的可信度。为克服这些局限，我们提出了放大群体输入的指标，并展示了这些指标预测客户端包接受成功更新的能力。我们还证明，来自客户端包的历史更新指标可用于提供更个性化的兼容性分数。基于我们的发现，我们认为，在利用群体智慧时，依赖管理机器人应包含置信区间以帮助校准客户端对兼容性分数可给予的信任，并考虑测试候选更新的质量。
英文摘要：
Dependabot, a popular dependency management tool, includes a compatibility score feature that helps client packages assess the risk of accepting a dependency update by leveraging knowledge from "the crowd". For each dependency update, Dependabot calculates this compatibility score as the proportion of successful updates performed by other client packages that use the same provider package as a dependency. In this paper, we study the efficacy of the compatibility score to help client packages assess the risks involved with accepting a dependency update. We analyze 579,206 pull requests opened by Dependabot to update a dependency, along with 618,045 compatibility score records calculated by Dependabot. We find that a compatibility score cannot be calculated for 83% of the dependency updates due to the lack of data from the crowd. Yet, the vast majority of the scores that can be calculated have a small confidence interval and are based on low-quality data, suggesting that client packages should have additional angles to evaluate the risk of an update and the trustworthiness of the compatibility score. To overcome these limitations, we propose metrics that amplify the input from the crowd and demonstrate the ability of those metrics to predict the acceptance of a successful update by client packages. We also demonstrate that historical update metrics from client packages can be used to provide a more personalized compatibility score. Based on our findings, we argue that, when leveraging the crowd, dependency management bots should include a confidence interval to help calibrate the trust clients can place in the compatibility score, and consider the quality of tests that exercise candidate updates.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
