一句话：通过实证研究揭示 PyPI 生态中库配置问题，表明仅靠版本级检查不足以保障运行时兼容。
Python 的流行很大程度上依赖 PyPI 生态中丰富的第三方库，但第三方库的使用可能引发依赖冲突。已有工作因此提出依赖冲突检测器，并尝试自动推断依赖；这些方法主要进行版本级检查和推断，并隐含假设 PyPI 生态中库的配置是正确的。本文对这一假设开展实证研究，发现其并非普遍成立，并进一步表明仅依赖版本级检查不足以确保运行时环境兼容。该结果对依赖管理工具与生态配置实践提出了警示，说明需要超越版本号、关注库配置与运行时兼容性的更全面机制。
Python is the top popular programming language used in the open-source community, largely owing to the extensive support from diverse third-party libraries within the PyPI ecosystem. Nevertheless, the utilization of third-party libraries can potentially lead to conflicts in dependencies, prompting researchers to develop dependency conflict detectors. Moreover, endeavors have been made to automatically infer dependencies. These approaches focus on version-level checks and inference, based on the assumption that configurations of libraries in the PyPI ecosystem are correct. However, our study reveals that this assumption is not universally valid, and relying solely on version-level checks proves inadequate in ensuring compatible run-time environments.
@inproceedings{paperbot11268,
title = {Less is More? An Empirical Study on Configuration Issues in Python PyPI Ecosystem},
author = {Yun Peng and Ruida Hu and Ruoke Wang and Cuiyun Gao and Shuqing Li and Michael R. Lyu},
booktitle = {ICSE},
year = {2024},
doi = {10.1145/3597503.3639077}
}