Grant: Discovery Grants Program - Individual

Software ecosystems, such as Maven and the Node Package Manager (NPM), enable developers to easily publish their code and reuse other people's code in the form of open source libraries. By facilitating code reuse, software ecosystems have profoundly changed how we develop software. Developers frequently include libraries as dependencies of their projects to avoid implementing features from scratch, speed up productivity, and improve software quality. As a result, the industry has never reused so much open source code: reports show that more than 80% of industrial software code comes from open source libraries, and thousands of new libraries are published weekly in ecosystems like Maven (Java) and NPM (JavaScript). However, the increasing reliance on open source libraries has created significant challenges in software maintenance. Developers struggle to maintain their dependencies and have to constantly react to dependencies issues, e.g., unmaintained libraries, breaking changes, and security vulnerabilities. We need solutions that help developers actively track and mitigate dependency issues throughout the evolution of their software. The long-term goal of my research program is to make dependency management more proactive. My research program aims at designing innovative solutions that monitor software ecosystems and warn developer teams about dependency issues and possible remediation strategies. Specifically, I plan to accomplish my objective by three short-term objectives: 1) Empirically examining the challenges of dependency management across large software ecosystems; 2) Developing analytical models and tools to increase developer's awareness of dependency issues, and 3) Designing agents that proactively monitor the software ecosystem to identify data patterns indicate and mitigate dependency management issues as early as possible. My research program will contribute to the open source community and the industry. Proactive solutions will help practitioners respond faster to dependency issues, reducing software maintenance costs and increasing the trust in the open source ecosystems. Furthermore, this research program will expose, train and enable highly qualified personnel to research using data analysis to solve engineering problems with strong industrial impact.